Summer Earn Protocol
ChainSecurity reviewed Summer (Summer Earn Protocol) on 14 Jan 2025: 46 findings, 0 critical; 39 marked fixed, 6 acknowledged, 1 open.
Report hosted on chainsecurity.com.
Trustblock does not review code.
Findings46
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 5 |
| Medium | 0 | 3 | 10 |
| Low | 1 | 3 | 24 |
HighSetting Rewards Manager Stores a Different AddressFixed
The report gives no description here.
HighState Not Updated Before StakingFixed
The report gives no description here.
HighTip Not CollectedFixed
The report gives no description here.
HighTipped Shares Not Taken Into AccountFixed
The report gives no description here.
HighWrong Order Assumption in Withdrawable Arks CachingFixed
The report gives no description here.
MediumAuctions Can Be Locked With Wrong Payment TokenFixed
The report gives no description here.
MediumCompounding Tip ModelFixed
The report gives no description here.
MediumDefault Auction Params May Not Include Fair Token PriceFixed
The report gives no description here.
MediumDisembarking AaveV3Ark Can FailFixed
The report gives no description here.
MediumGuardian Can Drain the Vesting WalletFixed
The report gives no description here.
Show 10 more
MediumMax Rebalance Flows Can Be CircumventedFixed
The report gives no description here.
MediumPosition Token Can Be Swept on ArksFixed
The report gives no description here.
Mediumprice_oracle Should Be Used to Read EMA PriceFixed
The report gives no description here.
MediumUnreached Goals Accounted After End of VestingFixed
The report gives no description here.
MediumWrong Direction for Buffer Adjustment ChecksFixed
The report gives no description here.
LowAave Can Be Withdrawn When FrozenFixed
The report gives no description here.
LowAdmiralsQuarters Does Not Include a Callpath to getReward() on the StakingRewardsManagerFixed
The report gives no description here.
LowCalling sweep() on the BufferArk Moves All the Buffered LiquidityFixed
The report gives no description here.
LowCode With No EffectFixed
The report gives no description here.
LowFleetCommander Shares Can Be Locked in the VaultFixed
The report gives no description here.
Show 10 more
LowInconsistent State of rewardTokensListFixed
The report gives no description here.
LowLast Array Element ShortcutFixed
The report gives no description here.
LowMisleading Function NameFixed
The report gives no description here.
LowMisleading Variable NameFixed
The report gives no description here.
LowMissing EventsFixed
The report gives no description here.
LowMissing Getter for DetailsFixed
The report gives no description here.
LowMissing Input SanitizationFixed
The report gives no description here.
LowNon Team Vesting Cannot Have GoalsFixed
The report gives no description here.
LowPositive Slippage in _swapPtForFleetAssetFixed
The report gives no description here.
LowRemove onlyCommanderFixed
The report gives no description here.
Show 9 more
LowRevert Instead of ReturnFixed
The report gives no description here.
LowSetting Duration of Vesting WalletFixed
The report gives no description here.
LowSimplify Redemption Post-ExpiryFixed
The report gives no description here.
LowSlippage Protection and Price Oracle in PendlePtOracleArkFixed
The report gives no description here.
LowStaking Token Can Be a Reward TokenFixed
The report gives no description here.
LowStorage Not Properly Cleaned After Ark RemovalFixed
The report gives no description here.
LowStronger Requirement for Commander RegistrationFixed
The report gives no description here.
LowTip Stream for address(0) Should Not Be AllowedFixed
The report gives no description here.
LowWrong SpecificationsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (29)
- packages/core-contracts/src/contracts/arks/libraries/AuctionManagerBase.sol
- packages/core-contracts/src/contracts/arks/BufferArk.sol
- packages/core-contracts/src/contracts/arks/libraries/StorageSlots.sol
- packages/rewards-contracts/src/contracts/StakingRewardsManagerBase.sol
- packages/core-contracts/src/contracts/arks/libraries/Raft.sol
- packages/core-contracts/src/contracts/arks/AaveV3Ark.sol
- packages/core-contracts/src/contracts/arks/libraries/ArkAccessManaged.sol
- packages/core-contracts/src/contracts/FleetCommanderRewardsManager.sol
- packages/core-contracts/src/utils/exchangeRateProvider/CurveExchangeRateProvider.sol
- packages/core-contracts/src/utils/CooldownEnforcer/CooldownEnforcer.sol
- packages/core-contracts/src/contracts/arks/libraries/Tipper.sol
- packages/access-contracts/src/contracts/ProtocolAccessManager.sol
- packages/access-contracts/src/contracts/ProtocolAccessManaged.sol
- packages/dutch-auction/src/DutchAuctionLibrary.sol
- packages/access-contracts/src/contracts/LimitedAccessControl.sol
- packages/core-contracts/src/utils/exchangeRateProvider/ExchangeRateProviderBase.sol
- packages/core-contracts/src/contracts/arks/libraries/FleetCommanderConfigProvider.sol
- packages/core-contracts/src/contracts/arks/libraries/FleetCommanderPausable.sol
- packages/core-contracts/src/contracts/arks/libraries/TipJar.sol
- packages/core-contracts/src/contracts/arks/PendlePtOracleArk.sol
- packages/gov-contracts/src/contracts/SummerVestingWallet.sol
- packages/dutch-auction/src/DecayFunctions.sol
- packages/core-contracts/src/contracts/arks/libraries/ConfigurationManaged.sol
- packages/core-contracts/src/contracts/arks/libraries/ArkConfigProvider.sol
- packages/dutch-auction/src/DutchAuctionMath.sol
- packages/core-contracts/src/contracts/arks/libraries/FleetCommanderCache.sol
- packages/core-contracts/src/contracts/arks/libraries/FleetCommander.sol
- packages/core-contracts/src/contracts/arks/AdmiralsQuarters.sol
- packages/core-contracts/src/contracts/arks/libraries/Ark.sol
Part of Summer’s security record
SummerSecurity firm
ChainSecurity81 projects reviewed · 286 reports · latest Sep 2026
See ChainSecurity’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us