Audit Report
Paladin reviewed Camelot DEX (Audit Report) on 30 Oct 2022: 70 findings, 0 critical; 63 marked fixed, 4 acknowledged, 3 open.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings70
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 5 |
| Medium | 0 | 0 | 7 |
| Low | 3 | 4 | 51 |
HighclaimMasterRewards function is fundamentally flawedFixed
The report gives no description here.
HighGovernance risk: Governance can drain the pairsFixed
The report gives no description here.
HighmergePositions allows anyone to steal other users positions and harvestsFixed
The report gives no description here.
HighMEV bots can drain one asset of the pairFixed
The report gives no description here.
HighRedeem finalization is fundamentally flawed, allowing for an exploiter to finalize a redeem multiple timesFixed
The report gives no description here.
Medium_k lacks overflow protectionFixed
The report gives no description here.
MediumAnyone can boost any other user’s NFT without any form of approval, allowing users to DoS the burning of NFTsFixed
The report gives no description here.
MediumGrailTokenV2 distributes emissions retroactively if emissions are re-enabled after being set to zeroFixed
The report gives no description here.
MediumThe destroyPosition function de-allocates from msg.sender instead of whomever allocated the actual boost pointsFixed
The report gives no description here.
MediumThe mergePositions function is flawed and may delete the entire positionsFixed
The report gives no description here.
Show 10 more
MediumThe owner fee can be used to block deposits and withdrawalsFixed
The report gives no description here.
MediumVarious functions including NFT transfers and updatePool are missing reentrancy-guardsFixed
The report gives no description here.
Low_allocate and _deallocate lack usage whitelistingFixed
The report gives no description here.
Low_checkOnNFTHarvest is flawed for harvestPositionToFixed
The report gives no description here.
Low_destroyPosition will revert in some edge-casesFixed
The report gives no description here.
Low_grailToken can be made immutableFixed
The report gives no description here.
Low_pools is privateFixed
The report gives no description here.
Low_requireOnlyOperatorOrOwnerOf and _requireOnlyApprovedOrOwnerOf are doing the sameFixed
The report gives no description here.
Low[Frontend] Phishing vulnerability for convertTo()Fixed
The report gives no description here.
LowAllocations during redemption are not captured in the usageAllocations variableFixed
The report gives no description here.
Show 10 more
Lowcreate2 not checked against a zero responseFixed
The report gives no description here.
Lowcreate2 success is unchecked (also present in Uniswap)Fixed
The report gives no description here.
LowExcess XGrailToken will get stuck in the contractFixed
The report gives no description here.
LowExternal calls after K check are undesiredFixed
The report gives no description here.
Lowfactory can be made immutableFixed
The report gives no description here.
LowforceDeallocate() does not unboost the pool position and does not properly function if the YieldBooster somehow gets out-of- sync with the XGrailTokenFixed
The report gives no description here.
LowGas optimizationFixed
The report gives no description here.
LowGas optimizationsFixed
The report gives no description here.
LowGas optimizationsFixed
The report gives no description here.
LowgetGrailByVestingDuration() can revert due to division by zeroFixed
The report gives no description here.
Show 10 more
LowgetPoolAddressByIndex and getActivePoolAddressByIndex are uncallable due to a faulty guard clauseFixed
The report gives no description here.
LowgetPoolInfo lacks a guard-clauseFixed
The report gives no description here.
LowGovernance risk: maxSupply can be changed to an infinitely large numberFixed
The report gives no description here.
LowharvestPositionTo exposes a frontend-phishing vulnerabilityFixed
The report gives no description here.
LowHarvests break if xGrailRewardsShare is ever set to zeroFixed
The report gives no description here.
LowInconsistency: _harvestPosition does not update the boost multiplier if isUnlocked is enabledFixed
The report gives no description here.
LowInconsistency: _safeRewardsTransfer avoids failure if contract has insufficient but such checks are not present for the xGrail amount that is harvestedFixed
The report gives no description here.
Lowinitialize function lacks an additional safeguardFixed
The report gives no description here.
LowLack of events in the constructorFixed
The report gives no description here.
LowLack of safeTransfer usage within _safeRewardsTransferFixed
The report gives no description here.
Show 10 more
LowLack of validationFixed
The report gives no description here.
LowLack of validationFixed
The report gives no description here.
LowmassUpdatePool only updates the active pools, causing potentially significant rewards to be distributed in hindsight if a pool is ever reactivatedFixed
The report gives no description here.
LowmergePositions is overprotective with the lock duration guardsFixed
The report gives no description here.
LowNewly added pools can dilute rewards retroactivelyFixed
The report gives no description here.
Lowpermit can be frontrun to prevent someone from calling removeLiquidityWithPermit (also present in Uniswap)Fixed
The report gives no description here.
Lowreceive() lacks a safeguardFixed
The report gives no description here.
LowrenewLockPosition and lockPosition do not work if the lock is expiredFixed
The report gives no description here.
LowSome private variables should be made publicFixed
The report gives no description here.
LowsplitPosition does not burn the position if its completely emptiedFixed
The report gives no description here.
Show 10 more
LowstartTime is not aligned with startTime from GrailTokenFixed
The report gives no description here.
LowThe createPosition function may create position with 0 amount when using tokens with a fee on transferFixed
The report gives no description here.
LowThe quote function returns erroneous values for the stableswapFixed
The report gives no description here.
LowThe transfer functions may have undesired side-effects with boosted tokensFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
Show 3 more
LowTypographical errors and gas optimizationsFixed
The report gives no description here.
LowUnused definitionFixed
The report gives no description here.
LowVarious functions are not guarded against reentrancyFixed
The report gives no description here.
Contracts in scope7
| Address | Chain | Source code |
|---|---|---|
| 0x3d9907f9a368ad0a51be60f7da3b97cf940982d8 | Chain: Arbitrum | Source code: Verified source |
| 0x3caae25ee616f2c8e13c74da0813402eae3f496b | Chain: Arbitrum | Source code: Verified source |
| 0x6db1ef0df42e30acf139a70c1ed0b7e6c51dbf6d | Chain: Arbitrum | Source code: Verified source |
| 0xc873fecbd354f5a56e00e710b90ef4201db2448d | Chain: Arbitrum | Source code: Verified source |
| 0x6eccab422d763ac031210895c81787e87b43a652 | Chain: Arbitrum | Source code: Verified source |
| 0xd27c373950e7466c53e5cd6ee3f70b240dc0b1b1 | Chain: Arbitrum | Source code: Verified source |
| 0x55401a4f396b3655f66bf6948a1a4dc61dfc21f4 | Chain: Arbitrum | Source code: Verified source |
Part of Camelot DEX’s security record
Camelot DEXSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us