Celo Contracts Audit
Audit · firm’s term: audit
OpenZeppelin reviewed Celo (Celo Contracts Audit) on 5 Feb 2021: 94 findings, 2 critical; 58 marked fixed, 5 acknowledged, 31 open.
Report hosted on blog.openzeppelin.com.
Trustblock does not review code.
Findings94
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 2 | 0 | 2 |
| Medium | 8 | 3 | 11 |
| Low | 21 | 2 | 43 |
High[H01] The approver role can prevent their own removalOpen
The report gives no description here.
High[H03] Elected validators of a group can be chosen by the validator group registrantOpen
The report gives no description here.
Medium[M01] Expired attestations lock fundsOpen
The report gives no description here.
Medium[M03] Users can avoid some slashing penalties by front-runningOpen
The report gives no description here.
Medium[M07] Elements with equal value within a Sorted List can be arbitrary orderedOpen
The report gives no description here.
Medium[M09] Contracts storage layout can be corrupted on upgradeable contractsOpen
The report gives no description here.
Medium[M10] Not using OpenZeppelin contractsOpen
The report gives no description here.
Medium[M11] Users are not able to verify releasesOpen
The report gives no description here.
Medium[M13] Missing test coverage reportOpen
The report gives no description here.
Medium[M14] The relations between loops and their boundaries are not clearOpen
The report gives no description here.
Show 10 more
Low[L01] Abi.encodePacked function receives dynamic-sized parametersOpen
The report gives no description here.
Low[L02] Interfaces are missing functions present in their implementationsOpen
The report gives no description here.
Low[L02] Sequential calls to removeExchangeSpender can revertOpen
The report gives no description here.
Low[L03] Interfaces don’t match with their implementationsOpen
The report gives no description here.
Low[L04] Not using the registry EIPOpen
The report gives no description here.
Low[L05] Incumbency Bias possible in validator electionsOpen
The report gives no description here.
Low[L05] Interfaces are missing functions present in their implementationsOpen
The report gives no description here.
Low[L06] Lack of validationOpen
The report gives no description here.
Low[L06] The relations between loops and their boundaries are not clearOpen
The report gives no description here.
Low[L10] Lack of validation consistencyOpen
The report gives no description here.
Show 10 more
Low[L10] Missing docstringsOpen
The report gives no description here.
Low[L11] Voting cap can be manipulatedOpen
The report gives no description here.
Low[L12] increaseSupply in GoldToken does not emit Transfer eventOpen
The report gives no description here.
Low[L13] Not using the SafeMath libraryOpen
The report gives no description here.
Low[L14] Account’s name field may allow phishing scenariosOpen
The report gives no description here.
Low[L14] Solidity compiler version is not pinned and it is not the same for all contractsOpen
The report gives no description here.
Low[L17] Excessive indirectionOpen
The report gives no description here.
Low[L20] TODO in reward calculations can cause revertsOpen
The report gives no description here.
Low[L23] There is no stable release cadenceOpen
The report gives no description here.
Low[L24] Missing changelogOpen
The report gives no description here.
Show 1 more
Low[L25] There are many stale branchesOpen
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (23)
- packages/protocol/contracts/identity/interfaces/IRandom.sol
- packages/protocol/contracts/stability/interfaces/IReserve.sol
- packages/protocol/contracts/common/UsingRegistry.sol
- packages/protocol/contracts/governance/LockedGold.sol
- packages/protocol/contracts/governance/Governance.sol
- packages/protocol/contracts/stability/Reserve.sol
- packages/protocol/contracts/common/UsingPrecompiles.sol
- packages/protocol/contracts/common/FractionUtil.sol
- packages/protocol/contracts/identity/Attestations.sol
- packages/protocol/contracts/governance/Proposals.sol
- packages/protocol/contracts/governance/SlasherUtil.sol
- packages/protocol/contracts/identity/Escrow.sol
- packages/protocol/contracts/baklava/Freezable.sol
- packages/protocol/contracts/common/interfaces/IValidators.sol
- packages/protocol/contracts/governance/EpochRewards.sol
- packages/protocol/contracts/common/Proxy.sol
- packages/protocol/contracts/stability/SortedOracles.sol
- packages/protocol/contracts/stability/interfaces/IStableToken.sol
- packages/protocol/contracts/common/FixidityLib.sol
- packages/protocol/contracts/governance/interfaces/IValidators.sol
- packages/protocol/contracts/governance/Validators.sol
- packages/protocol/contracts/stability/Exchange.sol
- packages/protocol/contracts/common/Initializable.sol
Part of Celo’s security record
CeloSecurity firm
OpenZeppelin67 projects reviewed · 184 reports · latest Aug 2026
See OpenZeppelin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us