Synthetix Auto Compound LP
Audit · firm’s term: security review
Part of Guardian Audits’ series
Guardian Audits reviewed Synthetix (Synthetix Auto Compound LP) on 14 May 2025: 80 findings, 1 critical; 24 marked fixed, 54 acknowledged, 2 open.
Report hosted on GitHub.
Trustblock does not review code.
Findings80
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 4 |
| Medium | 2 | 9 | 3 |
| Low | 0 | 45 | 16 |
MediumFaulty USDC Delta Check Can Be BypassedAcknowledged
The report gives no description here.
MediumKeeper : Lambda SG Allows All OutboundAcknowledged
The report gives no description here.
MediumKeeper : Unvalidated ODOS Swaps And Private KeyAcknowledged
The report gives no description here.
MediumKeeper : WAF Not EnabledAcknowledged
The report gives no description here.
MediumKeeper Ineffective /tmp Caching Logic Causes CrashAcknowledged
The report gives no description here.
MediumKeeper Wildcard SecretsManager PolicyAcknowledged
The report gives no description here.
MediumMigration Doesn't Check For Locked CollateralAcknowledged
The report gives no description here.
MediumPenalty Manipulation Allows Attacker To StealAcknowledged
The report gives no description here.
MediumStuck Rewards in RewardsDistributionRegistryAcknowledged
The report gives no description here.
LowAAVE Deposit/Redeem Limits May Affect stataUSDCAcknowledged
The report gives no description here.
Show 10 more
LowAlchemy API key can still be accessedAcknowledged
The report gives no description here.
LowCached Assets Don't Account For Redeem PenaltyAcknowledged
The report gives no description here.
LowClearing Debt May DOS The MigrationAcknowledged
The report gives no description here.
LowDonator Can Undelegate Vault CollateralAcknowledged
The report gives no description here.
LowDoS Due To Synthetix maxWrappableAmount LimitAcknowledged
The report gives no description here.
LowDoS In Reward Claiming Due To Strict SlippageAcknowledged
The report gives no description here.
LowInconsistent Calculations in case of USDC depeg.Acknowledged
The report gives no description here.
LowInterface Mismatch for migrateLP SignatureAcknowledged
The report gives no description here.
LowIssues With Reward Tokens Array HandlingAcknowledged
The report gives no description here.
LowKeeper : Dead Code / TODOsAcknowledged
The report gives no description here.
Show 10 more
LowKeeper : Hard-coded Resource IdentifiersAcknowledged
The report gives no description here.
LowKeeper : No Monitoring Of Keeper ETHAcknowledged
The report gives no description here.
LowKeeper : Non-optimal Lambda SizingAcknowledged
The report gives no description here.
LowKeeper : Opaque Cross-Stack ImportsAcknowledged
The report gives no description here.
LowKeeper : Potential Sandwich RiskAcknowledged
The report gives no description here.
LowKeeper : Sensitive Request/Response LoggingAcknowledged
The report gives no description here.
LowKeeper All addresses aren’t checksummedAcknowledged
The report gives no description here.
LowKeeper Invalid handler signatureAcknowledged
The report gives no description here.
LowKeeper L21 Partiallly Fixed: Missing Error Handling forAcknowledged
The report gives no description here.
LowKeeper Missing Input ValidationAcknowledged
The report gives no description here.
Show 10 more
LowKeeper RPC-Key is still hardcodedAcknowledged
The report gives no description here.
LowKeeper Slippage Tolerance Not Passed to ODOS inAcknowledged
The report gives no description here.
LowL-16 Partially Fixed : Rounding PenaltyAcknowledged
The report gives no description here.
LowLiquidations Break The VaultAcknowledged
The report gives no description here.
LowLocked Market Can Block RedeemAcknowledged
The report gives no description here.
LowLoss Of Rewards From Removed DistributorAcknowledged
The report gives no description here.
LowLoss Of Rewards When Updating rewardsRegistryAcknowledged
The report gives no description here.
LowMigration Omits Synthetix Reward ClaimingAcknowledged
The report gives no description here.
LowODOSRouter Max Approvals : Risk IncreasedAcknowledged
The report gives no description here.
LowOld Rewards Registry Retains Permissions AfterAcknowledged
The report gives no description here.
Show 10 more
Lowredeem Revert Due To Flash Loan UnderfundingAcknowledged
The report gives no description here.
LowRewards Discount Impacts Share CalculationsAcknowledged
The report gives no description here.
LowstataUSDC Should Not Be Added As RewardAcknowledged
The report gives no description here.
LowTokens With Invalid Prices Are Treated As 0Acknowledged
The report gives no description here.
LowToo Many Locks Can Block MigrationsAcknowledged
The report gives no description here.
LowtotalAssetsStata Can Be Slightly InflatedAcknowledged
The report gives no description here.
LowTrust AssumptionsAcknowledged
The report gives no description here.
LowUnconditional Rounding In _repay()Acknowledged
The report gives no description here.
LowUnfixed H-03Acknowledged
The report gives no description here.
LowUnnecessary Reward OperationAcknowledged
The report gives no description here.
Show 4 more
LowUnused Token Approvals To ODOS Pose Security RiskAcknowledged
The report gives no description here.
LowUse safeApprove() & safeTransfer()Acknowledged
The report gives no description here.
LowVault Deviates From ERC4626Acknowledged
The report gives no description here.
LowWrapperModule Rounding IssuesAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Synthetix’s security record
SynthetixSecurity firm
Guardian Audits15 projects reviewed · 99 reports · latest Aug 2026
See Guardian Audits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us