100x audit
Audit competition · firm’s term: security review
Sherlock reviewed 100x (100x audit) on 13 Feb 2024: 10 findings, 0 critical; 8 marked fixed, 2 acknowledged.
Findings10
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 2 | 5 |
| Low | 0 | 0 | 0 |
HighexecuteWithdrawal can be called by user after withdrawal timeout to withdraw full balance regardless of unrealized loss creating large bad debtFixed
The report gives no description here.
HighOff-chain health check for withdrawal and the other operations are not enough, lack of on-chain health check during withdrawal can cause user position to be unhealthy or in bad debtFixed
The report gives no description here.
HighOrderDispatch._matchOrder incorrectly reduces order.taker.quantity by filled quantity for each matched maker order instead of just onceFixed
The report gives no description here.
MediumAttacker can make first time taker's loose their funds by inflating feesFixed
The report gives no description here.
MediumDiscontinued/retired products or spot assets can be stolen/exploitedFixed
The report gives no description here.
MediumfeeRecepient and insurance special addresses might cause incorrect accounting and can potentially cause bad debtFixed
The report gives no description here.
MediumIncorrect spread liquidation for assets with 1e18 spreadPenaltyFixed
The report gives no description here.
MediumUser can DOS liquidation by front-running with a small deposit to cause the account to become initial margin healthy after liquidationFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of 100x’s security record
100xSecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us