The Moonpot / The Moonpot Contracts
Hacken reviewed The Moonpot (The Moonpot Contracts) on 4 Jun 2026: 37 findings, 0 critical; 26 marked fixed, 7 acknowledged, 4 open.
Report hosted on hacken.io.
Trustblock does not review code.
Findings37
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 2 |
| Medium | 1 | 1 | 3 |
| Low | 2 | 6 | 21 |
HighDefense Tax Calculation Inverted When USDC Is Token0Fixed
The report gives no description here.
HighNFT Transfers Reset Stored Round Data Due to Missing _extraData OverrideFixed
The report gives no description here.
MediumpendingLiquidityUsdc is Cleared Even When Liquidity Injection Does Not Consume all USDCFixed
The report gives no description here.
MediumquoteBuy Returns Zero TMP Output When USDC is currency0Fixed
The report gives no description here.
MediumRound Seed Can Be Overwritten by Duplicate VRF ResponsesFixed
The report gives no description here.
LowceilingTick is Not Validated Against Pool Tick SpacingFixed
The report gives no description here.
LowceilingTick Zero Check May Block Valid TickFixed
The report gives no description here.
LowClaim Functions Use Incorrect Custom Error for Zero roundIdFixed
The report gives no description here.
LowExternal Self-Calls in valueOf Add Gas OverheadFixed
The report gives no description here.
LowFloating PragmaFixed
The report gives no description here.
Show 10 more
LowIncomplete PositionIdSet Event and Misleading Function NameFixed
The report gives no description here.
LowInconsistent Ownable PatternFixed
The report gives no description here.
LowInconsistent Type Usage for NFT CountsFixed
The report gives no description here.
LowInterface Function Not ImplementedFixed
The report gives no description here.
LowLack of Event Emission in freezeBaseURIFixed
The report gives no description here.
LowlpFee and tickSpacing Should Be ConstantsFixed
The report gives no description here.
LowMisleading Error Name in retryRoundRevealFixed
The report gives no description here.
LowMissing Round ID Consistency Validation in setRoundFixed
The report gives no description here.
LowMissing State Validation in Round Lifecycle FunctionsFixed
The report gives no description here.
LowNo Floor Tick Validation Before SwapFixed
The report gives no description here.
Show 6 more
LowOwner Can DoS Protocol by Setting Insufficient VRF Callback Gas LimitFixed
The report gives no description here.
LowRedundant Errors and Event DeclarationsFixed
The report gives no description here.
LowRedundant Validation for VRF Coordinator AddressFixed
The report gives no description here.
LowsetVRFParams Does Not Allow Updating vrfConfirmationsFixed
The report gives no description here.
LowTEAPermuter Uses Fewer Feistel Rounds Than Tested ConfigurationFixed
The report gives no description here.
LowUnrestricted Maximum Defense Tax Allows Owner to Block All TMP SalesFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (13)
- contracts/AbstractMoonpotRound.sol
- contracts/MoonpotRound1.sol
- contracts/IMoonpotHook.sol
- contracts/lib/TEAPermuter.sol
- contracts/MoonpotToken.sol
- contracts/MoonpotManager.sol
- contracts/MoonpotHook.sol
- contracts/MoonpotRound5.sol
- contracts/MoonpotNFT.sol
- contracts/MoonpotRound4.sol
- contracts/MoonpotRound3.sol
- contracts/IMoonpotManager.sol
- contracts/MoonpotRound2.sol
Part of The Moonpot’s security record
The MoonpotSecurity firm
Hacken343 projects reviewed · 476 reports · latest Sep 2026
See Hacken’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us