Synthetix Auto Compound LP
Audit · firm’s term: security review
Part of Guardian Audits’ series
Guardian Audits reviewed Synthetix (Synthetix Auto Compound LP) on 14 May 2025: 80 findings, 1 critical; 24 marked fixed, 54 acknowledged, 2 open.
Report hosted on GitHub.
Trustblock does not review code.
Findings80
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 4 |
| Medium | 2 | 9 | 3 |
| Low | 0 | 45 | 16 |
CriticalUnauthorized Rewards Claiming Leads To LosesFixed
The report gives no description here.
HighAnyone Can Update Users userLastDepositedFixed
The report gives no description here.
HighKeeper : Swapping Unconfigured Tokens IncludingFixed
The report gives no description here.
HighTransfer Of SLP Shares Is Not Compatible WithFixed
The report gives no description here.
HighUSDC Rewards Break The AutoCompoundingLPFixed
The report gives no description here.
MediumKeeper : Hard-coded Secrets & RPC KeyFixed
The report gives no description here.
MediumKeeper : Plain-Text Private-Key HandlingFixed
The report gives no description here.
MediumKeeper : Reverts On USDC-To-USDC Swap AttemptFixed
The report gives no description here.
LowAlchemy API Key ExposedFixed
The report gives no description here.
LowKeeper : assembleOdosQuote May Use Expired OrFixed
The report gives no description here.
Show 10 more
LowKeeper : Default Slippage May Misprice RewardFixed
The report gives no description here.
LowKeeper : External Calls Lack Timeout & RetryFixed
The report gives no description here.
LowKeeper : getRewards Skips Tokens Held In VaultFixed
The report gives no description here.
LowKeeper : Incomplete Error HandlingFixed
The report gives no description here.
LowKeeper : Inefficient Secret RetrievalFixed
The report gives no description here.
LowKeeper : Missing Input ValidationFixed
The report gives no description here.
LowKeeper : Missing Validation On Rewards Return ValueFixed
The report gives no description here.
LowKeeper : Non-Checksummed AddressesFixed
The report gives no description here.
LowKeeper : Over-Permissive / Implicit Lambda RoleFixed
The report gives no description here.
LowKeeper : RemovalPolicy DESTROY On LogsFixed
The report gives no description here.
Show 4 more
LowKeeper : Short Log RetentionFixed
The report gives no description here.
LowKeeper :Outdated AWS CDK And Deprecated SDKFixed
The report gives no description here.
LowPenalty Rounding In Favor Of The UserFixed
The report gives no description here.
LowRewardsDistributionRegistry Lacks FlexibilityFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Synthetix’s security record
SynthetixSecurity firm
Guardian Audits15 projects reviewed · 99 reports · latest Aug 2026
See Guardian Audits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us