Flat Money audit
Audit competition · firm’s term: security review
Sherlock reviewed Flat Money (Flat Money audit) on 4 Feb 2024: 16 findings, 0 critical; 15 marked fixed, 1 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings16
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 8 |
| Medium | 0 | 1 | 7 |
| Low | 0 | 0 | 0 |
HighA malicious user can bypass limit order trading fees via cross-function re-entrancyFixed
The report gives no description here.
HighAsymmetry in profit and loss (PnL) calculationsFixed
The report gives no description here.
HighIncorrect handling of PnL during liquidationFixed
The report gives no description here.
HighIncorrect price used when updating the global position dataFixed
The report gives no description here.
HighLong trader's deposited margin can be wiped outFixed
The report gives no description here.
HighMalicious keepers can manipulate the price when executing an orderFixed
The report gives no description here.
HighThe transfer lock for leveraged position orders can be bypassedFixed
The report gives no description here.
HighTrade fees can be avoided in limit ordersFixed
The report gives no description here.
MediumFees are ignored when checks skew max in Stable Withdrawal / Leverage Open / Leverage AdjustFixed
The report gives no description here.
MediumIn LeverageModule.executeOpen/executeAdjust, vault.checkSkewMax should be called after updating the global position dataFixed
The report gives no description here.
Show 5 more
MediumLarge amounts of points can be minted virtually without any costFixed
The report gives no description here.
MediumLong traders unable to withdraw their assetsFixed
The report gives no description here.
MediumLosses of some long traders can eat into the margins of othersFixed
The report gives no description here.
MediumOracle can return different prices in same transactionFixed
The report gives no description here.
MediumOracle will not failover as expected during liquidationFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Flat Money’s security record
Flat MoneySecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us