Valkyrie Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed Paladin (Valkyrie Audit Report) on 12 Mar 2025: 26 findings, 3 critical; 23 marked fixed, 3 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings26
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 3 |
| High | 0 | 1 | 8 |
| Medium | 0 | 2 | 5 |
| Low | 0 | 0 | 7 |
CriticalPermissionless reward distribution can be abused to cause full denial of service and loss of funds for poolsFixed
The report gives no description here.
CriticalpoolRewards arrays can grow without bounds, resulting in DoS of core functionalityFixed
The report gives no description here.
CriticalReward tokens can become inaccessible due to revert when rewardPer- TokenStored is downcast and overflowsFixed
The report gives no description here.
HighDenial of service for swaps on MultiRangeHook poolsFixed
The report gives no description here.
HighManipulation of price outside of the FullRangeHook liquidity range can result in DoS and financial loss to liquidity providersFixed
The report gives no description here.
HighMissing user liquidity sync in TimeWeightedIncentiveLogic::_updateAllUserState can result in rewards becoming lockedFixed
The report gives no description here.
HighPrecision loss can result in funds becoming stuck in incentive logic contractsFixed
The report gives no description here.
HighReward distribution can be blocked by an initial distribution of long durationFixed
The report gives no description here.
HighRewards distributed with TimeWeightedIncentiveLogic can continue to be claimed after the distribution endsFixed
The report gives no description here.
HighSwaps are not possible on pools registered with Bunni due to incorrect access control in ValkyrieHooklet::afterSwapFixed
The report gives no description here.
Show 10 more
HighSwaps performed in pools with zero liquidity can cause a complete DoS of FullRangeHookFixed
The report gives no description here.
MediumDeposited rewards get stuck in incentive logic contracts when there is no pool liquidityFixed
The report gives no description here.
MediumIncentivizedERC20 should not be hardcoded to 18 decimalsFixed
The report gives no description here.
MediumMissing duplicate Incentive Logic can result in Incentive System accounting being brokenFixed
The report gives no description here.
MediumMissing slippage protection when removing liquidityFixed
The report gives no description here.
MediumTimeWeightedIncentiveLogic distributions are not possible for tokens that revert on zero transfersFixed
The report gives no description here.
LowInability to remove hooks and Incentive Systems from the Incentive ManagerFixed
The report gives no description here.
LowMisleading liquidity value returned when adding liquidityFixed
The report gives no description here.
LowMissing tick validation when creating a new range in MultiRangeHookFixed
The report gives no description here.
LowMissing zero address validation in BoostedIncentiveLogicFixed
The report gives no description here.
Show 3 more
LowPositions can be locked by malicious re-initialization in the event of multiple ValkyrieSubscriber contracts being deployedFixed
The report gives no description here.
LowUnsafe downcast in ValkyrieSubscriber::toInt256 could silently overflowFixed
The report gives no description here.
LowValue mistakenly sent to PoolCreator can be permanently lockedFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Paladin’s security record
PaladinSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us