Tokemak security review

Hexens26 Dec 2024Code version: not recorded (see the report)

Hexens reviewed Tokemak (Tokemak security review) on 26 Dec 2024: 5 findings, 1 critical; all marked fixed.

1 critical finding, fixed

Open the report Open Tokemak’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	1
High	0	0	1
Medium	0	0	1
Low	0	0	2

CriticalTransient swap routes can be set for other smart contract users to steal tokensFixed

The report gives no description here.

HighEtherFi and Kelp DAO vault extensions can be DoS-edFixed

The report gives no description here.

MediumRedstone oracle and CustomSetOracle time validation differences can lead to issues when updating the priceFixed

The report gives no description here.

LowDirect usage of RedstoneConsumerBase in consumer contractFixed

The report gives no description here.

LowIncentive update extension effectively bypasses the incentive calculator checksFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Tokemak’s security record

Tokemak

Audits6 audits by 2 firmsLast audit Mar 2025, by Hexens.

Critical findingsNo open critical findingsAcross the 6 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it.

Open Tokemak’s security record

Security firm

Hexens

32 projects reviewed · 75 reports · latest Jul 2026

See Hexens’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.