Cove security review
Pashov Audit Group reviewed Cove (Cove security review) on 16 Jan 2025: 23 findings, 0 critical; 20 marked fixed, 3 acknowledged.
Findings23
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 0 | 5 |
| Low | 0 | 3 | 13 |
HighIncorrect basket USD value will cause incorrect resultsFixed
The report gives no description here.
HighThe target weight check does not account for redeem request assetsFixed
The report gives no description here.
MediumDeviation check upon validating external trades is unidirectionalFixed
The report gives no description here.
MediumLoss of surplus if ERC-1271 order allows arbitrary dataFixed
The report gives no description here.
MediumMissing ERC20Permit init call in initialize()Fixed
The report gives no description here.
MediumorderValidTo assumes stepDelay is always 15 minutesFixed
The report gives no description here.
MediumupdateBitFlag does not update the index of the base assetFixed
The report gives no description here.
LowexecuteTokenSwap can be called with empty externalTradesFixed
The report gives no description here.
LowExternal trades tradeOwnership is not validatedFixed
The report gives no description here.
LowFully claiming fees requires a batch of 2 claimsFixed
The report gives no description here.
Show 10 more
LowHardcoded slippage is dangerousFixed
The report gives no description here.
LowLack of restriction on BasketManager's executeFixed
The report gives no description here.
LowMalicious users can decrease management fees accrualFixed
The report gives no description here.
LowManagement fees might not accrueFixed
The report gives no description here.
LowManagementFee calculation does not match the documentationFixed
The report gives no description here.
LowNot transferring already collected claimableSponsorFeesFixed
The report gives no description here.
LowPrecision loss in _processExternalTrades()Fixed
The report gives no description here.
LowproRataRedeem() lacks a check to verify if msg.sender is the operatorFixed
The report gives no description here.
LowThe rebalance requirement check is too sensitiveFixed
The report gives no description here.
Lowtrade.maxAmount check in the _processInternalTrades()Fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Cove’s security record
CoveSecurity firm
Pashov Audit Group30 projects reviewed · 53 reports · latest Jul 2026
See Pashov Audit Group’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us