Audit Report
Paladin reviewed BlackrockFund (Audit Report) on 2 Mar 2024: 37 findings, 0 critical; 3 marked fixed, 34 acknowledged.
Trustblock does not review code.
Findings37
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 7 | 2 |
| Medium | 0 | 8 | 1 |
| Low | 0 | 19 | 0 |
HighCentralised riskAcknowledged
The report gives no description here.
HighDOMAIN_SEPARATOR is not implemented in BTC.sol permit()Acknowledged
The report gives no description here.
HighGovernance can call several functions that can cause funds to be stuck in the contractAcknowledged
The report gives no description here.
HighGovernance can mint/rebase freelyAcknowledged
The report gives no description here.
HighRebase mechanism is very fragileAcknowledged
The report gives no description here.
HighThe bond price can be set to any valueAcknowledged
The report gives no description here.
HighVesting applies to the full bonded amountAcknowledged
The report gives no description here.
MediumBTC and USDC rewards are claimed togetherAcknowledged
The report gives no description here.
MediumBTC rewards collected are always less than what is calculatedAcknowledged
The report gives no description here.
MediumIt is disadvantageous for users to stake LPs compared to staking BTCAcknowledged
The report gives no description here.
Show 10 more
MediumThe bond cap can be circumventedAcknowledged
The report gives no description here.
MediumThe contract works only with USDC with 6 decimalsAcknowledged
The report gives no description here.
MediumUsers who deposit after having accrued rewards are debasing their own BTCAcknowledged
The report gives no description here.
Mediumwithdraw() can be backrun by an adversaryAcknowledged
The report gives no description here.
MediumWithdrawal fee is applied on all of the previous deposits even if the last deposit is a small amountAcknowledged
The report gives no description here.
LowFees are rounded downAcknowledged
The report gives no description here.
LowFees are rounded downAcknowledged
The report gives no description here.
LowFuture airdrops can be stuck in the contractAcknowledged
The report gives no description here.
LowGas optimizationsAcknowledged
The report gives no description here.
LowGas optimizationsAcknowledged
The report gives no description here.
Show 10 more
LowGas optimizationsAcknowledged
The report gives no description here.
LowGovernance also pays fees for redeeming the collected feesAcknowledged
The report gives no description here.
LowLack of eventsAcknowledged
The report gives no description here.
LowmaUSDCPerSecond is declared incorrectly to be 1e20 instead of 1e18Acknowledged
The report gives no description here.
LowRounding vulnerability of tokens with very large supply can cause users to receive zero rewardsAcknowledged
The report gives no description here.
LowSmall precision on fees calculationAcknowledged
The report gives no description here.
LowstETH could be lost when redeeming with a contractAcknowledged
The report gives no description here.
LowSybil attack is still possibleAcknowledged
The report gives no description here.
LowThe 401k contract seems unnecessaryAcknowledged
The report gives no description here.
LowThe contract does not work with tokens that have a fee on transferAcknowledged
The report gives no description here.
Show 4 more
LowThe usage of SafeMath is obsoleteAcknowledged
The report gives no description here.
LowTypographical issuesAcknowledged
The report gives no description here.
LowTypographical issuesAcknowledged
The report gives no description here.
LowTypographical issues and gas optimizationsAcknowledged
The report gives no description here.
Contracts in scope5
| Address | Chain | Source code |
|---|---|---|
| 0x1fde0d2f44539789256d94d1784a86bf77d66dd0 | Chain: Ethereum | Source code: Verified source |
| 0xef9e6123eff4dae9db1e6d585884b45b369a8ad1 | Chain: Ethereum | Source code: Verified source |
| 0x1e4a10d18698e4450e13b4e8ef361a5841850611 | Chain: Ethereum | Source code: Verified source |
| 0xa709aad0691fc67279577566640ae1d6515c1b81 | Chain: Ethereum | Source code: Verified source |
| 0xbd6323a83b613f668687014e8a5852079494fb68 | Chain: Ethereum | Source code: Verified source |
Part of BlackrockFund’s security record
BlackrockFundSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us