Audit Report
Paladin reviewed YieldWolf (Audit Report) on 24 Sep 2021: 28 findings, 0 critical; 25 marked fixed, 3 acknowledged.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings28
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 7 |
| Medium | 0 | 0 | 4 |
| Low | 0 | 3 | 14 |
HighearnAmount might not equate to the same token amount harvested, but balance of the strategy contractFixed
The report gives no description here.
HighImproper calculation of userNativeValueFixed
The report gives no description here.
HighMultiple emergencyWithdraw calls on underlying farms with deposit/ withdraw fees, or uses a fee on transfer tokenFixed
The report gives no description here.
HighRule is vulnerable to price manipulation attacksFixed
The report gives no description here.
HighsetExtraEarnTokens has no maximum length for extraEarnTokens, which can result in denial of service for the earn functionFixed
The report gives no description here.
HighSwapRouter can be modified by the ownerFixed
The report gives no description here.
HightotalValueLockedNative uses LP underlying balances to calculate the pricingFixed
The report gives no description here.
Mediumfarm() does not check if contract is pausedFixed
The report gives no description here.
MediumLack of ability to remove added rules for an accountFixed
The report gives no description here.
MediumLack of validation of extraEarnTokens in setExtraEarnTokensFixed
The report gives no description here.
Show 10 more
MediumruleFeeAmount is based on the percentage of the user’s staked amount, instead of the withdraw amountFixed
The report gives no description here.
LowAction’s execute and callback should not need to pass the _yieldWolf parameterFixed
The report gives no description here.
Lowblock.timestamp can be used as the deadline for swaps and adding liquidityFixed
The report gives no description here.
Lowearn may fail if the underlying farm prevents harvesting with 0 as the withdraw amountFixed
The report gives no description here.
LowexecuteRule should be limited to EOA only to reduce the attack surfaceFixed
The report gives no description here.
LowLack of cap for number of rules for each account in a poolFixed
The report gives no description here.
LowLack of rule and action contract validationFixed
The report gives no description here.
LowLack of sanity check for _stakeToken and _strategy when adding a new poolFixed
The report gives no description here.
LowParameter array length checks are not done in addManyFixed
The report gives no description here.
LowReentrancy guard is not done on withdrawFromFixed
The report gives no description here.
Show 5 more
LowsetRuleFee is checking against PERFORMANCE_FEE_CAP instead of RULE_EXECUTION_FEE_CAPFixed
The report gives no description here.
Lowtoken0 and token1 should be obtained from the LP contract if stake token is an LPFixed
The report gives no description here.
LowtokenToEarn can fail if the token does not have a native token pair, or the liquidity pool has insufficient liquidity for a successful swapFixed
The report gives no description here.
LowtokenToEarn lacks sufficient token validationFixed
The report gives no description here.
LowtokenToEarn reverts if earnToken is a token attempted to be swappedFixed
The report gives no description here.
Contracts in scope4
| Address | Chain | Source code |
|---|---|---|
| 0xbf65023bcf48ad0ab5537ea39c9242de499386c9 | Chain: Polygon (POS) | Source code: Verified source |
| 0x7de84ee43c4f7ba0487b77cd5dd6f2d15903b33d | Chain: Polygon (POS) | Source code: Verified source |
| 0x250b171274befa912c0993fb037705920bb5147b | Chain: Polygon (POS) | Source code: Verified source |
| 0x6d879b9c3b85f2fe42e29318bdfa15055c6fa787 | Chain: Polygon (POS) | Source code: Verified source |
Part of YieldWolf’s security record
YieldWolfSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us