XO Market EVM Contracts audit
ABDK Consulting reviewed XO Market (XO Market EVM Contracts audit) on 2 Dec 2025: 87 findings, 0 critical; 31 marked fixed, 56 acknowledged.
Report hosted on GitHub.
Statuses are the security firm’s own, from this report. Trustblock does not review code.
Findings87
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 6 | 10 |
| Low | 0 | 50 | 20 |
HighThere is no check to ensure elements or “outcomes” array are unique.Fixed
The report gives no description here.
MediumAll these fees will be distributed to future shareholders (probably to the very first future shareholder), who didn’t actually hold shares at the time these fees were earned.Fixed
The report gives no description here.
MediumOverflow is possible when converting to “int256”.Fixed
The report gives no description here.
MediumPhantom overflow is possible here, i.e.Fixed
The report gives no description here.
MediumPhantom overflow is possible here, i.e.Fixed
The report gives no description here.
MediumPhantom overflow is possible here, i.e.Fixed
The report gives no description here.
MediumProcedural in XOMarketConfiguration-Fixed
The report gives no description here.
MediumSuboptimal in LSLMSRDynamic.solFixed
The report gives no description here.
MediumSuboptimal in XOFeeHandler.solFixed
The report gives no description here.
MediumThere is no check to ensure the “outcomes” and “amounts” arrays are of the same length.Fixed
The report gives no description here.
Show 10 more
MediumThis function duplicates logic of the “previewClaimable” function.Fixed
The report gives no description here.
LowBad datatype in LSLMSRDynamic.solFixed
The report gives no description here.
LowBad datatype in XOMarketConfigurationManager.solFixed
The report gives no description here.
LowBad datatype in XOMarketConfigurationManager.solFixed
The report gives no description here.
LowBad datatype in XOMarketFactoryV1.solFixed
The report gives no description here.
LowBad datatype in XOMarketFactoryV1Storage.solFixed
The report gives no description here.
LowBad naming in XOMarketFactoryV1.solFixed
The report gives no description here.
LowBad naming in XOMarketV1.solFixed
The report gives no description here.
LowIn ERC-20 the “decimals” property is used by UI to render token amounts in a human-readable way.Fixed
The report gives no description here.
LowIt is unclear, why decimals=0 is forbidden, while decimals=1 is not.Fixed
The report gives no description here.
Show 10 more
LowReadability in LSLMSRDynamic.solFixed
The report gives no description here.
LowReadability in XOMarketConfigurationManager.solFixed
The report gives no description here.
LowReadability in XOMarketV1.solFixed
The report gives no description here.
LowSpecifying constant values in comments is a bad practice as values in comments could easily get out of sync with actual values in the code.Fixed
The report gives no description here.
LowSuboptimal in LSLMSRDynamic.solFixed
The report gives no description here.
LowSuboptimal in XOMarketOutcome.solFixed
The report gives no description here.
LowThe “from” and “to” addresses are compared to zero twice.Fixed
The report gives no description here.
LowThe argument names doesn’t match corresponding internal variable names.Fixed
The report gives no description here.
LowThe immutable variables names and the corresponding argument names doesn’t match each other.Fixed
The report gives no description here.
LowThe semantics of the keys in these mappings is unclear.Fixed
The report gives no description here.
Show 1 more
LowThis condition was already checked and is guaranteed to be true here.Fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of XO Market’s security record
XO MarketSecurity firm
ABDK Consulting31 projects reviewed · 64 reports · latest Jan 2026
See ABDK Consulting’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us