Tokemak security review

Hexens22 Jul 2024Code version: not recorded (see the report)

Hexens reviewed Tokemak (Tokemak security review) on 22 Jul 2024: 21 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Tokemak’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings21

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	7
Medium	0	0	8
Low	0	0	6

Marked Informational by the firm. Not counted as findings.

InformationalConstant variables should be marked as privateAcknowledged

The report gives no description here.

InformationalInconsistent usage of constant values and literalsAcknowledged

The report gives no description here.

InformationalStaked Toke will still earn rewards after lockup has expiredAcknowledged

The report gives no description here.

InformationalUse of external calls to the same contractAcknowledged

The report gives no description here.

InformationalInitial total assets high mark missing timestamp and eventFixed

The report gives no description here.

InformationalMissing events on configuration changesFixed

The report gives no description here.

InformationalThe snapshot for the extra rewarder can be taken without permissionFixed

The report gives no description here.

InformationalWithdrawn lock ups can still be extendedFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Tokemak’s security record

Tokemak

Audits6 audits by 2 firmsLast audit Mar 2025, by Hexens.

Critical findingsNo open critical findingsAcross the 6 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it.

Open Tokemak’s security record

Security firm

Hexens

32 projects reviewed · 74 reports · latest Jul 2026

See Hexens’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.