Tokemak security review
Hexens reviewed Tokemak (Tokemak security review) on 22 Jul 2024: 21 findings, 0 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings21
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 7 |
| Medium | 0 | 0 | 8 |
| Low | 0 | 0 | 6 |
HighIncorrect Streaming Fee Share CalculationFixed
The report gives no description here.
HighIncorrect update for safeTotalSupply when the distribution is ended in function IncentiveCalculatorBase._snaps hotRewarder()Fixed
The report gives no description here.
HighIncorrect updating of lastUpdateBlock could result in a loss of rewardsFixed
The report gives no description here.
HighLoss of Reward from DestinationVaultMainRewarder if the Destination is Empty After RebalanceFixed
The report gives no description here.
HighPositive price movements of vault assets can be directly stolen through withdrawFixed
The report gives no description here.
HighPotential DoS attack of AutoPool's rebalance and debt reporting functions due to division by zero in profit locking calculation from AutoPoolFeesFixed
The report gives no description here.
HighThe value of currentSafeTotalSupply within the function IncentiveCalculatorBase.curren t() can be outdated.Fixed
The report gives no description here.
MediumAutopoolETH redeem incorrectly calculates remaining pull from idleFixed
The report gives no description here.
MediumFee configuration update does not sync to latest timestampFixed
The report gives no description here.
MediumImmediate Reward for the First Staker if Time Has PassedFixed
The report gives no description here.
Show 10 more
MediumMissing deadline parameter in _performLiquidationFixed
The report gives no description here.
MediumPotential revert in AutoPoolDebt.withdraw() functionFixed
The report gives no description here.
MediumThe discounts on LST stats may be missedFixed
The report gives no description here.
MediumUnclaimed rewards in ExtraRewarder can be stolen if removed from MainRewarderFixed
The report gives no description here.
MediumUpdate debt reporting does not validate whether spot price is safeFixed
The report gives no description here.
LowAccToke minimum stake duration can be zeroFixed
The report gives no description here.
LowGas optimisation in fetching total assetsFixed
The report gives no description here.
LowIncorrect logic of catching getFee() failingFixed
The report gives no description here.
LowNew NAV per share calculation when setting streaming fee could be staleFixed
The report gives no description here.
LowSome dust rewards will be stuck in LiquidationRowFixed
The report gives no description here.
Show 1 more
LowTellorOracle freshness duration configurationFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Tokemak’s security record
TokemakSecurity firm
Hexens32 projects reviewed · 74 reports · latest Jul 2026
See Hexens’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us