Vana security review
Audit · firm’s term: security review
Nethermind Security reviewed Vana (Vana security review) on 9 Apr 2025: 11 findings, 5 critical; 9 marked fixed, 2 acknowledged.
Findings11
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 5 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 2 | 0 |
CriticalEntity owners can withdraw their minimum registration stakeFixed
The report gives no description here.
CriticalExcessive calls to processRewards(...) cause higher reward rate, regardless of time elapsedFixed
The report gives no description here.
CriticalSame stake can be migrated multiple timesFixed
The report gives no description here.
CriticalStakers funds are locked on entity removalFixed
The report gives no description here.
CriticalUsers can withdraw their DLP stakes and migrate to the VANA pool simultaneouslyFixed
The report gives no description here.
HighprocessRewards(...) is called too late in unstake(...)Fixed
The report gives no description here.
MediumThe stake(...) and unstake(...) functions lack slippage protectionFixed
The report gives no description here.
MediumThe unstake(...) function should use entityShareToVana(...) to round down to favor protocolFixed
The report gives no description here.
MediumUnauthorized execution of migrateStakeToVanaPool(...) on behalf of othersFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Vana’s security record
VanaSecurity firm
Nethermind Security57 projects reviewed · 81 reports · latest Sep 2026
See Nethermind Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us