Audit Report
Paladin reviewed Abachi (Audit Report) on 8 Mar 2022: 50 findings, 0 critical; 3 marked fixed, 47 acknowledged.
Trustblock does not review code.
Findings50
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 3 | 1 |
| Medium | 0 | 7 | 0 |
| Low | 0 | 37 | 2 |
HighauditReserves is wrongly implementedAcknowledged
The report gives no description here.
HighGov Privilege: Governance can change crucial aspects of the protocol to potentially drain the contracts of all supplied tokensAcknowledged
The report gives no description here.
HighStaked amount is relocked on subsequent stakes, even if the stake is made by third-parties allowing for targeted Denial of ServiceAcknowledged
The report gives no description here.
MediumDoes not support LP pairs where the second currency has less than 9 decimalsAcknowledged
The report gives no description here.
MediumGuardian account can circumvent limit amount of tokens to a recipient by providing wrong parameters to setAdjustmentAcknowledged
The report gives no description here.
MediumRebases can be arbitraged/frontranAcknowledged
The report gives no description here.
MediumThe last governor, vault, guardian and policy can be reclaimedAcknowledged
The report gives no description here.
MediumThe last policy can be reclaimedAcknowledged
The report gives no description here.
MediumThe maximum debt can be exceeded by at most maxPayoutAcknowledged
The report gives no description here.
MediumTokenomics: Withdrawal of the Treasury fundsAcknowledged
The report gives no description here.
Show 10 more
Lowabi, treasury and staking are privateAcknowledged
The report gives no description here.
LowAdding a token as both a liquidity and reserve token would cause it to be double counted in the treasury valueAcknowledged
The report gives no description here.
LowAdjustment target is never reachedAcknowledged
The report gives no description here.
LowAdjustments are not reset when recipient is removedAcknowledged
The report gives no description here.
LowblocksNeededForQueue can be initialized with 0 making timelock obsoleteAcknowledged
The report gives no description here.
LowbondPriceInUSD is denominated in the decimals of the other token in the LP and might not be correct for non stablecoin LPsAcknowledged
The report gives no description here.
LowContract could theoretically run out of ABIAcknowledged
The report gives no description here.
LowContract does not work with a zero vestingTermAcknowledged
The report gives no description here.
Lowdeposit is vulnerable to reentrancy if the principle has a reentrancy vectorAcknowledged
The report gives no description here.
Lowdeposit is vulnerable to reentrancy if the quoteToken has a reentrancy vectorAcknowledged
The report gives no description here.
Show 10 more
LowgABI, staking, treasury and abi are privateAcknowledged
The report gives no description here.
LowGas Optimization on auditReserveAcknowledged
The report gives no description here.
LowGas Optimization on constant variablesAcknowledged
The report gives no description here.
LowGas optimization: Contract uses hardcoded strings in SafeMath functionsAcknowledged
The report gives no description here.
LowGas optimization: Contract uses hardcoded strings in SafeMath functionsAcknowledged
The report gives no description here.
LowGas optimization: storage variables are frequently unnecessarily rereadAcknowledged
The report gives no description here.
LowGas Optimization: UNAUTHORIZED can be constantAcknowledged
The report gives no description here.
LowInapplicable deployment-related issuesAcknowledged
The report gives no description here.
LowInfrequent rebases incentivize malicious parties to strategically (re)order transactions for arbitrage and steal all rebased tokens off the LP pairsAcknowledged
The report gives no description here.
LowinitializeBondTerms has no validationAcknowledged
The report gives no description here.
Show 10 more
LowLack of component safeguards in a system that plans to increase in number of components over time is considered brittleAcknowledged
The report gives no description here.
LowLack of component safeguards on setRewardsAcknowledged
The report gives no description here.
LowLack of events for various functionsAcknowledged
The report gives no description here.
Lowmarkdown function is vulnerable to price manipulationAcknowledged
The report gives no description here.
Lowmint function can be used to mint large amounts of tokens by vault ownersAcknowledged
The report gives no description here.
Lowpermit can be frontrun and cause denial of serviceAcknowledged
The report gives no description here.
Lowpermit can be frontrun and cause denial of serviceAcknowledged
The report gives no description here.
Lowpermit can be frontrun and cause denial of serviceAcknowledged
The report gives no description here.
LowPhishing riskAcknowledged
The report gives no description here.
LowrepayDebtWithAbi has inconsistent privilege requirements which allows for slight privilege escalationAcknowledged
The report gives no description here.
Show 7 more
LowStandardBondingCalculator can only value pairs in which the two tokens have equal “value”Acknowledged
The report gives no description here.
LowThe contracts do not work with fee-on-transfer tokensAcknowledged
The report gives no description here.
LowUnbounded gas usage due to extensive for-loop usageAcknowledged
The report gives no description here.
LowUnder a constant and small circulating supply, the non-circulating supply starts increasing more rapidly with every rebaseAcknowledged
The report gives no description here.
LowUnused variables/dependencies throughout the contractsAcknowledged
The report gives no description here.
LowVarious functions can be made externalAcknowledged
The report gives no description here.
LowWrong parameters on events for policy, vault, guardian and governorAcknowledged
The report gives no description here.
Contracts in scope11
| Address | Chain | Source code |
|---|---|---|
| 0x925a785a347f4a03529b06c50fa1b9a10808cab5 | Chain: Polygon (POS) | Source code: Verified source |
| 0xed6aab1615aac7bc4c108dfd4fdc9ad0c8304d47 | Chain: Polygon (POS) | Source code: Verified source |
| 0xa360a98046ecd9ef961dfa4e3ea30b398556172b | Chain: Polygon (POS) | Source code: Verified source |
| 0x321019dc2df5d09a47d3cf4d8319e82fef9d75d4 | Chain: Polygon (POS) | Source code: Verified source |
| 0x105bcddabdf5e8a4e14c8e23b2e8d9ba220143c2 | Chain: Polygon (POS) | Source code: Verified source |
| 0xc55686ccad36cf586f79658529e3a4e9bb43ddaf | Chain: Polygon (POS) | Source code: Verified source |
| 0x4b2bd29b81d32e3dbceb47260f0bbc76a6a0b8cd | Chain: Polygon (POS) | Source code: Verified source |
| 0x9d38b914b3755a697eea39d9a146eb1a39516bc8 | Chain: Polygon (POS) | Source code: Verified source |
| 0xe05be52b9fb121c63afeb526b154b790936ff170 | Chain: Polygon (POS) | Source code: Verified source |
| 0x6d5f5317308c6fe7d6ce16930353a8dfd92ba4d7 | Chain: Polygon (POS) | Source code: Verified source |
Show the other 1 addresses
| Address | Chain | Source code |
|---|---|---|
| 0x52c7260edde404e0ac200e3119fca39bb3f4896e | Chain: Polygon (POS) | Source code: Verified source |
Part of Abachi’s security record
AbachiSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us