Notional Audit
Audit · firm’s term: audit
OpenZeppelin reviewed Notional Finance (Notional Audit) on 22 Dec 2020: 39 findings, 3 critical; 20 marked fixed, 19 open.
Report hosted on blog.openzeppelin.com.
Trustblock does not review code.
Findings39
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 3 |
| High | 1 | 0 | 4 |
| Medium | 8 | 0 | 6 |
| Low | 10 | 0 | 7 |
Critical[C01] All USDC can be drained from fCash markets with very little collateralFixed
The report gives no description here.
Critical[C02] ERC777 deposits can be credited twiceFixed
The report gives no description here.
Critical[C03] Borrow rates can be severely miscalculatedFixed
The report gives no description here.
High[H02] Chainlink rates may need to be invertedFixed
The report gives no description here.
High[H03] _getImpliedRate does not handle errorsFixed
The report gives no description here.
High[H04] Rounding when performing div causes inconsistent balancesFixed
The report gives no description here.
High[H05] Wrong value in call can cause money to be incorrectly withdrawn from reservesFixed
The report gives no description here.
Medium[M01] ERC777 tokens may not implement ERC20 functionsFixed
The report gives no description here.
Medium[M03] Math issues in SafeInt256.solFixed
The report gives no description here.
Medium[M04] Unchecked ERC20 return valuesFixed
The report gives no description here.
Show 10 more
Medium[M05] Cash settling during low liquidity deletes cash receiver tokensFixed
The report gives no description here.
Medium[M06] Not all calculations use SafeMathFixed
The report gives no description here.
Medium[M09] Owner of Portfolios can disable marketsFixed
The report gives no description here.
Low[L01] Anyone can call the initializeDependencies function in CashMarket.solFixed
The report gives no description here.
Low[L01] INSTRUMENT_PRECISION is not fixedFixed
The report gives no description here.
Low[L02] _listCurrency function has no input checksFixed
The report gives no description here.
Low[L03] div should always be performed as late as possible in calculationsFixed
The report gives no description here.
Low[L04] _checkUniswapRateDifference may not use highest percentage differenceFixed
The report gives no description here.
Low[L05] Token fees are not accounted forFixed
The report gives no description here.
Low[L06] futureCashGroups parameters may not match FutureCash parametersFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (19)
- contracts/utils/Governed.sol
- contracts/ERC1155Token.sol
- contracts/utils/RiskFramework.sol
- contracts/storage/EscrowStorage.sol
- contracts/storage/PortfoliosStorage.sol
- contracts/lib/SafeInt256.sol
- contracts/Escrow.sol
- contracts/utils/Common.sol
- contracts/utils/MockLiquidation.sol
- contracts/interface/IERC1155TokenReceiver.sol
- contracts/interface/IERC165.sol
- contracts/utils/Liquidation.sol
- contracts/CashMarket.sol
- contracts/ERC1155Trade.sol
- contracts/Portfolios.sol
- contracts/utils/ExchangeRate.sol
- contracts/interface/IAggregator.sol
- contracts/interface/IERC777.sol
- contracts/utils/Directory.sol
Part of Notional Finance’s security record
Notional FinanceSecurity firm
OpenZeppelin67 projects reviewed · 184 reports · latest Aug 2026
See OpenZeppelin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us