Maverick Phase 2 audit
ABDK Consulting reviewed Maverick Protocol (Maverick Phase 2 audit) on 11 May 2023: 72 findings, 0 critical; 37 marked fixed, 35 acknowledged.
Report hosted on GitHub.
Statuses are the security firm’s own, from this report. Trustblock does not review code.
Findings72
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 7 |
| Medium | 0 | 6 | 7 |
| Low | 0 | 29 | 23 |
High(POSSIBLY CRITICAL) The ‘encodePacked‘ function simply concatenates arrays, so the same output may be produced for different inputs, resulting in collisions in ‘hash‘ value.Fixed
The report gives no description here.
HighIn case ”propertionD18” is greater that 1e18, this formula effectively decreases it to 1e18.Fixed
The report gives no description here.
HighThe value ”binIds.length” is read from the storage multiple times.Fixed
The report gives no description here.
HighThe value ”rewardData.length” is read from the storage multiple times.Fixed
The report gives no description here.
HighThere is no range check for these arrays.Fixed
The report gives no description here.
HighThese constant names are useless.Fixed
The report gives no description here.
HighThis function allows multiple initialization.Fixed
The report gives no description here.
MediumOnly the first element of this array is actually populated.Fixed
The report gives no description here.
MediumThe result of this calculation could be greater than one.Fixed
The report gives no description here.
MediumThe returned value is ignored.Fixed
The report gives no description here.
Show 10 more
MediumThere is no length check for these arrays.Fixed
The report gives no description here.
MediumThis function allows a transferrer to transferring tokens from arbitrary addresses.Fixed
The report gives no description here.
MediumThis function is very dangerous as it allows the minter to burn tokens from arbitrary accounts without explicit approval.Fixed
The report gives no description here.
MediumUsing compiler-enforced underflow protection to check business-level constraints is a bad practice.Fixed
The report gives no description here.
LowBad datatype in Distributor.solFixed
The report gives no description here.
LowBad datatype in PoolPositionAndRewardFactory.solFixed
The report gives no description here.
LowBad datatype in RewardPusher.solFixed
The report gives no description here.
LowBad naming in PoolPositionBase.solFixed
The report gives no description here.
LowBad naming in RewardVote.solFixed
The report gives no description here.
LowBad naming in VoterToken.solFixed
The report gives no description here.
Show 10 more
LowProcedural in PoolPositionAndRewardFactory.solFixed
The report gives no description here.
LowReadability in PoolPositionAndRewardFactory.solFixed
The report gives no description here.
LowReadability in RewardOpen.solFixed
The report gives no description here.
LowSuboptimal in Poll.solFixed
The report gives no description here.
LowSuboptimal in PoolPositionAndRewardFactory.solFixed
The report gives no description here.
LowSuboptimal in PoolPositionAndRewardFactory.solFixed
The report gives no description here.
LowSuboptimal in PoolPositionRouter.solFixed
The report gives no description here.
LowSuboptimal in RewardPusher.solFixed
The report gives no description here.
LowThese functions should emit some events.Fixed
The report gives no description here.
LowThese functions should emit some events.Fixed
The report gives no description here.
Show 7 more
LowThese functions should emit some events.Fixed
The report gives no description here.
LowThis compiler version requirement is inconsistent with other files.Fixed
The report gives no description here.
LowThis compiler version requirement is inconsistent with other files.Fixed
The report gives no description here.
LowThis compiler version requirement is inconsistent with other files.Fixed
The report gives no description here.
LowThis event is emitted even when ”amount” is zero.Fixed
The report gives no description here.
LowThis function should emit some event.Fixed
The report gives no description here.
LowThis variable is redundant.Fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Maverick Protocol’s security record
Maverick ProtocolSecurity firm
ABDK Consulting31 projects reviewed · 64 reports · latest Jan 2026
See ABDK Consulting’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us