Fei Protocol Audit

OpenZeppelinFiles named in the report

Audit · firm’s term: audit

OpenZeppelin reviewed Fei Protocol (Fei Protocol Audit) on 5 Feb 2021: 23 findings, 5 critical; 15 marked fixed, 8 open.

5 critical findings, fixed
Open the reportOpen Fei Protocol’s security record

Report hosted on blog.openzeppelin.com.

Trustblock does not review code.

Findings23

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical005
High102
Medium204
Low504
Critical[C01] Anyone can steal all the TRIBE tokens from the reward poolFixed

The report gives no description here.

Critical[C02] ETH can get stuck in the GenesisGroup contractFixed

The report gives no description here.

Critical[C03] Anyone can partially bypass the FEI sell penalty to earn a profitFixed

The report gives no description here.

Critical[C04] Users can claim unreleased rewards or have their funds lockedFixed

The report gives no description here.

Critical[C05] Anyone with enough liquidity to reach the maxGenesisPrice can make profit from genesisFixed

The report gives no description here.

High[H01] Users participating in Genesis can get fewer FEI and TRIBE than expectedFixed

The report gives no description here.

High[H02] Outdated oracle prices being used throughout the protocolFixed

The report gives no description here.

Medium[M02] Inverse price fetched from UniswapFixed

The report gives no description here.

Medium[M03] Rounding errors in Roots library reduce FEI received from bonding curveFixed

The report gives no description here.

Medium[M04] Incorrect proposal and quorum thresholds for votingFixed

The report gives no description here.

Show 5 more
Medium[M05] ETH and FEI can get locked in EthUniswapPCVDepositFixed

The report gives no description here.

Low[L01] Approved addresses can forfeit user rewardsFixed

The report gives no description here.

Low[L03] Core contract cannot allocate all Tribe tokensFixed

The report gives no description here.

Low[L05] Not checking for 0 addressesFixed

The report gives no description here.

Low[L10] UniswapOracle does not allow overflowFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (18)

  • contracts/genesis/GenesisGroup.sol
  • contracts/pcv/IUniswapPCVController.sol
  • contracts/external/SafeMathCopy.sol
  • contracts/core/Core.sol
  • contracts/token/Fei.sol
  • contracts/bondingcurve/BondingCurve.sol
  • contracts/utils/Timed.sol
  • contracts/oracle/UniswapOracle.sol
  • contracts/pool/Pool.sol
  • contracts/token/IFei.sol
  • contracts/dao/Tribe.sol
  • contracts/orchestration/BondingCurveOrchestrator.sol
  • contracts/token/UniswapIncentive.sol
  • contracts/token/IUniswapIncentive.sol
  • contracts/pcv/EthUniswapPCVController.sol
  • contracts/oracle/IOracle.sol
  • contracts/pcv/IPCVDeposit.sol
  • contracts/token/IIncentive.sol

Part of Fei Protocol’s security record

Fei Protocol
Audits5 audits by 2 firmsLast audit Sep 2021, by Consensys.
Critical findings1 open critical findingReported in “Fei Tribechief” by Consensys, Jul 2021. Not marked fixed in that report.
Open Fei Protocol’s security record

Security firm

OpenZeppelin

67 projects reviewed · 184 reports · latest Aug 2026

See OpenZeppelin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us