Audit Report
Paladin reviewed Iris (Audit Report) on 11 Aug 2021: 16 findings, 0 critical; all marked fixed.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings16
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 14 |
HighSeverely excessive rewards issue when a token with a transfer tax is addedFixed
The report gives no description here.
MediumupdateStartBlock does not update poolInfo.lastRewardBlockFixed
The report gives no description here.
LowAdding an EOA or a non-token contract as a pool will break updatePool, massUpdatePools and updateEmissionRateFixed
The report gives no description here.
LowdelegateBySig can be frontrun and cause denial of serviceFixed
The report gives no description here.
Lowdeposit, withdraw, emergencyWithdraw, and updateStartBlock functions can be made externalFixed
The report gives no description here.
LowGovernance functionality is broken (present in all Goose forks)Fixed
The report gives no description here.
LowLack of events for add, set, setReferralCommissionRate, and updateStartBlockFixed
The report gives no description here.
Lowmint function can be used to pre-mint large amounts of tokens before ownership is transferred to the MasterchefFixed
The report gives no description here.
LowNative tokens can be minted beyond the hard-cap limitationFixed
The report gives no description here.
LowPools use the contract balance to figure out the total depositsFixed
The report gives no description here.
Show 6 more
LowrecordReferral function can be made externalFixed
The report gives no description here.
LowSetting devAddress and feeAddress to the zero address will break updatePool and deposit functionality respectivelyFixed
The report gives no description here.
LowThe owner of the Referral contract can overwrite themselves as the referrer for all users using the recordReferral functionFixed
The report gives no description here.
LowThe pendingIris function will revert if totalAllocPoint is zeroFixed
The report gives no description here.
LowThere are no sanity checks in the setReferralAddress functionFixed
The report gives no description here.
LowupdateEmissionRate has no maximum safeguardFixed
The report gives no description here.
Contracts in scope4
| Address | Chain | Source code |
|---|---|---|
| 0xdab35042e63e93cc8556c9bae482e5415b5ac4b1 | Chain: Polygon (POS) | Source code: Verified source |
| 0xdc99fe88118cde8316df10eb16c722c3967e73fd | Chain: Polygon (POS) | Source code: Verified source |
| 0x4aa8def481d19564596754cd2108086cf0bdc71b | Chain: Polygon (POS) | Source code: Verified source |
| 0xe83ecf8077538ad80373e7cc12fdfeffa3b63559 | Chain: Polygon (POS) | Source code: Verified source |
Part of Iris’s security record
IrisSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us