XO Market EVM Contracts audit
ABDK Consulting reviewed XO Market (XO Market EVM Contracts audit) on 2 Dec 2025: 87 findings, 0 critical; 31 marked fixed, 56 acknowledged.
Report hosted on GitHub.
Statuses are the security firm’s own, from this report. Trustblock does not review code.
Findings87
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 6 | 10 |
| Low | 0 | 50 | 20 |
MediumCalculating this value on each invocation is suboptimal.Acknowledged
The report gives no description here.
MediumConverting configuration parameters from uint into quad-precision floating point numbers on every function invocation is suboptimal.Acknowledged
The report gives no description here.
MediumConverting constant uint values into quad-precision floating point numbers on-chain is waste of gas.Acknowledged
The report gives no description here.
MediumExecuting a heavy operation just to calculate event parameters is a bad practice, as these calculations could be performed off-chain.Acknowledged
The report gives no description here.
MediumPerforming this division every time is suboptimal.Acknowledged
The report gives no description here.
MediumSuboptimal in XOMarketV1.solAcknowledged
The report gives no description here.
LowBad datatype in XOFeeHandler.solAcknowledged
The report gives no description here.
LowBad datatype in XOFeeHandler.solAcknowledged
The report gives no description here.
LowBad datatype in XOFeeHandlerStorage.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketConfigurationManager.solAcknowledged
The report gives no description here.
Show 10 more
LowBad datatype in XOMarketConfigurationManager.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketConfigurationManager.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketConfigurationManager.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketFactoryV1.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketFactoryV1.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketFactoryV1.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketFactoryV1.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketFactoryV1.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketFactoryV1.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketFactoryV1.solAcknowledged
The report gives no description here.
Show 10 more
LowBad datatype in XOMarketFactoryV1.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketFactoryV1.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketV1.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketV1.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketV1.solAcknowledged
The report gives no description here.
LowBad datatype in XOMarketV1.solAcknowledged
The report gives no description here.
LowConsider specifying as “^0.8.0’ unless there is something special regarding this particular version.Acknowledged
The report gives no description here.
LowDeclaring a top-level structure in a file named after a library makes it harder navigating through code.Acknowledged
The report gives no description here.
LowIn ERC-20 the “decimals” property is used by UI to render token amounts in a human-readable way.Acknowledged
The report gives no description here.
LowProcedural in XOFeeHandler.solAcknowledged
The report gives no description here.
Show 10 more
LowProcedural in XOFeeHandler.solAcknowledged
The report gives no description here.
LowProcedural in XOFeeHandler.solAcknowledged
The report gives no description here.
LowSolidity compiler is smart enough to precompute constant hash expressions.Acknowledged
The report gives no description here.
LowSolidity compiler is smart enough to precompute constant hash expressions.Acknowledged
The report gives no description here.
LowSolidity compiler is smart enough to precompute constant hash expressions.Acknowledged
The report gives no description here.
LowSolidity compiler is smart enough to precompute constant hash expressions.Acknowledged
The report gives no description here.
LowSuboptimal in LSLMSRDynamic.solAcknowledged
The report gives no description here.
LowSuboptimal in XOFeeHandlerStorage.solAcknowledged
The report gives no description here.
LowSuboptimal in XOMarketConfigurationManager.solAcknowledged
The report gives no description here.
LowSuboptimal in XOMarketV1.solAcknowledged
The report gives no description here.
Show 10 more
LowThese checks are redundant, as it is anyway possible to pass dead addresses.Acknowledged
The report gives no description here.
LowThese events are emitted even if nothing actually changed.Acknowledged
The report gives no description here.
LowThis check seems redundant, as it is anyway possible to pass a dead resolver address.Acknowledged
The report gives no description here.
LowThis event is emitted even if nothing actually changed.Acknowledged
The report gives no description here.
LowUPPER_CASE identifiers are commonly used for constants, not for immutable variables.Acknowledged
The report gives no description here.
LowUPPER_CASE identifiers are commonly used for constants, rather than for immutable variables.Acknowledged
The report gives no description here.
LowWe didn’t review these files.Acknowledged
The report gives no description here.
LowWe didn’t review these files.Acknowledged
The report gives no description here.
LowWe didn’t review these files.Acknowledged
The report gives no description here.
LowWe didn’t review these files.Acknowledged
The report gives no description here.
Show 6 more
LowWe didn’t review these files.Acknowledged
The report gives no description here.
LowWe didn’t review these files.Acknowledged
The report gives no description here.
LowWe didn’t review this file.Acknowledged
The report gives no description here.
LowWe didn’t review this file.Acknowledged
The report gives no description here.
LowWe didn’t review this file.Acknowledged
The report gives no description here.
LowWe didn’t review this file.Acknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of XO Market’s security record
XO MarketSecurity firm
ABDK Consulting31 projects reviewed · 64 reports · latest Jan 2026
See ABDK Consulting’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us