Tangent security review
Audit · firm’s term: security review
Pashov Audit Group reviewed Tangent (Tangent security review) on 12 Nov 2025: 23 findings, 0 critical; 18 marked fixed, 5 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings23
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 5 | 15 |
MediumFailure of USDT token supportFixed
The report gives no description here.
MediumLosses in extreme scenarios due to missing collateral checkFixed
The report gives no description here.
MediumWaste or unfairness from incorrect reward distributionFixed
The report gives no description here.
Low“No-fail” path may return invalid price if primary fails without fallbackFixed
The report gives no description here.
LowConflicting liquidation fee limits in MarketCore init and CollateralFixed
The report gives no description here.
LowCritical setter functions lack event emissions for parameter changesFixed
The report gives no description here.
LowDivision-by-zero risk in IRCalculator when irParam.pMax equals irParam.pMinFixed
The report gives no description here.
LowDouble-floor rounding in borrow path slightly favors usersFixed
The report gives no description here.
LowIncorrect Unit Validation for startCutPriceFixed
The report gives no description here.
LowKick incentive can round to zero (no motivation to kick small locks)Fixed
The report gives no description here.
Show 8 more
LowMiscalculation of leftover rewards when processRewards is called with zero total supplyFixed
The report gives no description here.
LowOff-by-one cap prevents setting max allowed liquidation fee in CollateralFixed
The report gives no description here.
LowOff-by-one on unlock: == endLockTime cannot unlockFixed
The report gives no description here.
LowSlippage protection fails during partial liquidationFixed
The report gives no description here.
LowUnlimited minting in claimRewards() if maxWithdraw() returns maxFixed
The report gives no description here.
LowWStable mint/burn misused ERC4626 preview functionsFixed
The report gives no description here.
LowZappingProxy cannot receive ETH refunds resulting in failed zapsFixed
The report gives no description here.
LowZero repayment risk from rounding in partial liquidationFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Tangent’s security record
TangentSecurity firm
Pashov Audit Group86 projects reviewed · 165 reports · latest Aug 2026
See Pashov Audit Group’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us