Covenant security review
Audit · firm’s term: security review
Pashov Audit Group reviewed Covenant (Covenant security review) on 31 Aug 2025: 25 findings, 0 critical; 22 marked fixed, 3 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings25
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 5 |
| Low | 0 | 3 | 16 |
HighNot excluding accruedProtocolFee from state update operations causes several issuesFixed
The report gives no description here.
MediumEarly market can be DoSed by over-minting debtFixed
The report gives no description here.
MediumETWAP logic allows grief attacks on redeem flowFixed
The report gives no description here.
MediumMarket DoS when baseTokenSupply is 0 while Synth token supply is non-zeroFixed
The report gives no description here.
MediumRedeem cap bypassed using swap()Fixed
The report gives no description here.
MediumSynthToken returns incorrect name, symbol, and decimalsFixed
The report gives no description here.
LowApproximate swap fee used for exact_out instead of exact calculationFixed
The report gives no description here.
LowETWAP check blocks the last user from immediate full withdrawalFixed
The report gives no description here.
LowInconsistent LTV blocks zToken redemptions during undercollateralizationFixed
The report gives no description here.
LowInconsistent price reset behavior in full redemption scenariosFixed
The report gives no description here.
Show 10 more
LowInconsistent redeem cap allows excessive withdrawalsFixed
The report gives no description here.
LowIncorrect 512-bit number comparison in computeLiquidity functionFixed
The report gives no description here.
LowIncorrect concat usage corrupts token name and symbolFixed
The report gives no description here.
LowLoss of protocol fee due to lack of decimal consideration during accrualFixed
The report gives no description here.
LowMarket state broken: mint() disabled but swaps creating debt allowedFixed
The report gives no description here.
LowMissing zero amount validation for non-base asset outputs in swapsFixed
The report gives no description here.
LowPotential division-by-zero in _dexToSynthFixed
The report gives no description here.
LowPreview functions fail to verify the outputsFixed
The report gives no description here.
LowProtocol can be DOS due to arithmetic underflow in interest accrualFixed
The report gives no description here.
LowProtocol fee updates cause loss of accrued feesFixed
The report gives no description here.
Show 2 more
Lowredeem caps inputs for calculation but burns uncapped amounts, causing revertsFixed
The report gives no description here.
Lowswap operation can lead to an undercollateralized stateFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Covenant’s security record
Security firm
Pashov Audit Group86 projects reviewed · 165 reports · latest Aug 2026
See Pashov Audit Group’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us