Audit Report
Paladin reviewed Covenant (Audit Report) on 23 Jun 2022: 18 findings, 0 critical; 15 marked fixed, 3 acknowledged.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings18
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 3 | 12 |
HighThe MerkleDistributor unnecessarily allows for separate rewards to be stolen from each other if a single merkle tree allows to withdraw more rewards than were provided to that tree which allows forFixed
The report gives no description here.
MediumGas grief risk: The priceDisputed callback might not be guaranteed to execute which could permanently lock-in fundsFixed
The report gives no description here.
MediumUsers can call createReward with any whitelisted price identifierFixed
The report gives no description here.
LowAn unprivileged syncUmaEcosystemParams function might be undesirableFixed
The report gives no description here.
LowbondToken can be made immutableFixed
The report gives no description here.
LowChecks-effects-interactions is not adhered to within various functionsFixed
The report gives no description here.
LowGas optimizationsFixed
The report gives no description here.
LowGovernance risk: Governance can pre-configure windows with malicious Merkle trees before transferring ownershipFixed
The report gives no description here.
LowipfsHash and customAncillaryData are privateFixed
The report gives no description here.
LowipfsHash is privateFixed
The report gives no description here.
Show 5 more
LowLack of validationFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
LowUnnecessary import: SafeMath.solFixed
The report gives no description here.
LowUnused import: StoreInterface.solFixed
The report gives no description here.
Contracts in scope2
| Address | Chain | Source code |
|---|---|---|
| 0x2e2b1ba85f1110a793fc97b6aba9dcb7fc8bc346 | Chain: Polygon (POS) | Source code: Verified source |
| 0xe53b310431157eea3592f8b4de92df0bed429139 | Chain: Polygon (POS) | Source code: Verified source |
Part of Covenant’s security record
Security firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us