dForce

QuantstampFiles named in the report

Audit

Quantstamp reviewed dForce on 15 Dec 2020: 12 findings, 0 critical; 1 marked fixed, 11 acknowledged.

No open critical findings
Open the reportOpen dForce’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings12

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium031
Low080
MediumUniswap Oracle ManipulationFixed

The implemented `Oracle` contract in `UniswapOracle.sol` calls the uniswap router to get the swap output value to be used as price estimation. However, depending on its usage, the router output can be manipulated by trading X amount back and forth on that specific Uniswap pair and the oracle call can be placed in between.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (57)

  • contracts/storage/DFCollateral.sol
  • contracts/storage/interfaces/IDFPool.sol
  • contracts/oracle/PriceFeed.sol
  • contracts/utility/Utils.sol
  • contracts/mock/DTokenController.sol
  • contracts/converter/DFProtocol.sol
  • contracts/storage/interfaces/IDFStore.sol
  • Funds.sol
  • contracts/token/ERC20SafeTransfer.sol
  • USR.sol
  • contracts/utility/DSValue.sol
  • contracts/utility/DSThing.sol
  • contracts/token/interfaces/IDSToken.sol
  • Chargeable.sol
  • Pausable.sol
  • Migrations.sol
  • ERC20Pausable.sol
  • contracts/converter/interfaces/IDFEngine.sol
  • InterestProvider.sol
  • DSAuth.sol
  • USRProxy.sol
  • contracts/storage/interfaces/IDFCollateral.sol
  • contracts/token/interfaces/IDSWrappedToken.sol
  • contracts/utility/DSNote.sol
  • contracts/converter/interfaces/IDFProtocol.sol
  • contracts/token/DSToken.sol
  • contracts/oracle/UniswapOracle.sol
  • contracts/utility/DSMath.sol
  • contracts/token/Collaterals_t.sol
  • contracts/storage/DFFunds.sol
  • contracts/storage/interfaces/IDToken.sol
  • contracts/storage/interfaces/IDTokenController.sol
  • contracts/oracle/Medianizer.sol
  • contracts/storage/DFStore.sol
  • contracts/utility/ReentrancyGuard.sol
  • contracts/storage/DFPool.sol
  • contracts/token/interfaces/IERC20Token.sol
  • contracts/token/DSWrappedToken.sol
  • contracts/oracle/interfaces/IMedianizer.sol
  • contracts/storage/DFPoolV2.sol
  • DSGuard.sol
  • contracts/converter/DFEngine.sol
  • contracts/helpers/Migrations.sol
  • contracts/mock/DToken.sol
  • contracts/utility/DFProxy.sol
  • contracts/update/DFUpgrader.sol
  • contracts/storage/interfaces/IDFFunds.sol
  • contracts/utility/DSGuard.sol
  • IInterestProvider.sol
  • contracts/storage/interfaces/IDFPoolV2.sol
  • contracts/token/interfaces/IERC20.sol
  • SafeRatioMath.sol
  • contracts/converter/DFProtocolView.sol
  • contracts/converter/DFEngineV2.sol
  • contracts/converter/DFSetting.sol
  • contracts/utility/DSAuth.sol
  • USDx.sol

Part of dForce’s security record

dForce
Audits2 audits by 2 firmsLast audit Mar 2021, by Consensys.
Critical findingsNo open critical findingsAcross 2 reports.
IncidentIncident 9 Feb 2023Source: De.Fi incident database.
Open dForce’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us