Audit Report
Paladin reviewed RimauSwap Finance (Audit Report) on 4 Sep 2021: 38 findings, 0 critical; 5 marked fixed, 33 acknowledged.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings38
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 3 |
| Medium | 0 | 3 | 0 |
| Low | 0 | 29 | 2 |
HighSeverely excessive rewards issue when a token with a transfer tax is addedAcknowledged
The report gives no description here.
MediumDuplicated pools may be added to the MasterchefAcknowledged
The report gives no description here.
MediumFee is miscalculated in getAmountOut and getAmountIn functions causing users to pay a slightly excessive fee of 0.05% when they tradeAcknowledged
The report gives no description here.
MediumFunctions are not secure from reentrancyAcknowledged
The report gives no description here.
LowAdding an EOA or a non-token contract as a pool will break updatePool and massUpdatePoolsAcknowledged
The report gives no description here.
LowAdding EOA or non-token contract as a pool is possibleAcknowledged
The report gives no description here.
LowApproval event is not emitted if allowance is changed in transferFrom as suggested in the ERC-20 Token Standard (also present in Uniswap)Acknowledged
The report gives no description here.
Lowcake and syrup can be made immutableAcknowledged
The report gives no description here.
LowContract cannot handle tokens with transfer taxesAcknowledged
The report gives no description here.
LowContract still references CakeAcknowledged
The report gives no description here.
Show 10 more
LowContract still references CakeAcknowledged
The report gives no description here.
LowContract still references Cake and Rimau is mis-spelledAcknowledged
The report gives no description here.
LowdelegateBySig can be frontrun and cause denial of serviceAcknowledged
The report gives no description here.
LowdelegateBySig can be frontrun and cause denial of serviceAcknowledged
The report gives no description here.
Lowdev function can be renamedAcknowledged
The report gives no description here.
LowdevAddr cannot be changedAcknowledged
The report gives no description here.
LowGovernance functionality is brokenAcknowledged
The report gives no description here.
LowGovernance functionality is brokenAcknowledged
The report gives no description here.
LowLack of events for setAdmin, setTreasury, setPerformanceFee, setCallFee, setWithdrawFee, setWithdrawFeePeriod, emergencyWithdraw and inCaseTokensGetStuckAcknowledged
The report gives no description here.
LowLack of events for updateMultiplier, add and setAcknowledged
The report gives no description here.
Show 10 more
LowLack of events for updateMultiplier, add, set, dev and emergencyWithdrawAcknowledged
The report gives no description here.
LowMinting will break if multiplier is set to a very high valueAcknowledged
The report gives no description here.
LowPairs without supply but with a partial reserve might crash the frontend if the user wants to swap on this pair (this issue is present in most frontends)Acknowledged
The report gives no description here.
Lowpause and unpause emit two eventsAcknowledged
The report gives no description here.
LowPermit can be front-run to prevent someone from calling removeLiquidityWithPermit (also present in Uniswap)Acknowledged
The report gives no description here.
LowPhishing is possible by a malicious frontend by adjusting routes, tokens or from parameters (Also present in Uniswap and Pancakeswap)Acknowledged
The report gives no description here.
LowPools use the contract balance to figure out the total depositsAcknowledged
The report gives no description here.
LowRedundant comments can be deletedAcknowledged
The report gives no description here.
LowRounding vulnerability to tokens with a very large supply can cause large supply tokens to receive zero emissionsAcknowledged
The report gives no description here.
LowThe pendingCake function will revert if totalAllocPoint is zeroAcknowledged
The report gives no description here.
Show 3 more
LowupdateMultiplier has no safeguardsAcknowledged
The report gives no description here.
LowupdateMultiplier, add and set functions can be made externalAcknowledged
The report gives no description here.
LowupdateMultiplier, add, set, deposit, withdraw, enterStaking, leaveStaking, emergencyWithdraw and dev functions can be made externalAcknowledged
The report gives no description here.
Contracts in scope7
| Address | Chain | Source code |
|---|---|---|
| 0x64e8dad72feb8af8261d377a0a2c1441e3589a75 | Chain: BNB Chain | Source code: Verified source |
| 0x6fe0c579b14d3fffdcf13c3d4bfeb40aa3675509 | Chain: BNB Chain | Source code: Verified source |
| 0xafd546e7bce1e7d60c7fc7fcf9f101639b09763d | Chain: BNB Chain | Source code: Verified source |
| 0x672875d2dfb5bc4771d09c6e601fafdebb999a36 | Chain: BNB Chain | Source code: Verified source |
| 0x93aede7f6242de095e71dd39d338c263bfc58cca | Chain: BNB Chain | Source code: Verified source |
| 0x098dcbf3518856e45bb4e65e7fcc7c5ff4a2c16e | Chain: BNB Chain | Source code: Verified source |
| 0xa78aac0c0551ab3470f40ff5a382f0cdbfa31b7b | Chain: BNB Chain | Source code: Verified source |
Part of RimauSwap Finance’s security record
RimauSwap FinanceSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us