Vector Reserve

QuantstampRepository at commit 6c92889

Audit

Quantstamp reviewed Vector Reserve on 22 Feb 2024: 12 findings, 0 critical; 1 marked fixed, 11 acknowledged.

No open critical findings
Open the reportOpen Vector Reserve’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings12

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium021
Low090
MediumSandwich Attacks and Price ManipulationFixed

A common attack in DeFi is the sandwich attack. Upon observing a trade of asset X for asset Y, an attacker front-runs the victim trade by also buying asset Y, lets the victim execute the trade, and then executes another trade after the victim by trading back the amount gained in the first trade. Intuitively, one uses the knowledge that someone’s going to buy an asset and that this trade will increase its price, to make a profit. The attacker’s plan is to buy this asset cheaply, let the victim buy at an increased price, and then sell the received amount again at a higher price afterward. The swap performed in `swapETHForTokens()` and `addLiquidity()` for LP bonds (`WETHTOLP ` type) currently accept any amount of tokens in return, making them vulnerable to sandwich attacks. The Vector team should be aware of this possible attack, especially if the taxes in the Vector token are disabled, increasing the attacker's profitability, or if the max payout is sufficiently high to cover the fees plus some profit. Additionally, there have been cases with similar token contracts where an attacker could force the token contract to swap its balance in one pool which would lower its price, buy the token low in that pool, and sell it high in the second pool if the token is listed in multiple DEXs.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (30)

  • https://github.com/vectorreserve/vector-contracts/contracts/balancer/vETHRateProvider.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/libraries/FixedPoint.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/interface/IERC20.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/interface/IStaking.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/interface/IsVEC.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/interface/balancer/IRateProvider.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/tokens/VectorETH.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/tokens/sVEC.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/interface/ITreasury.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/interface/IVEC.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/libraries/FullMath.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/tokens/StakedVectorETH.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/tokens/Vector.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/interface/IvETH.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/reward/RewardDistributor.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/interface/eigenlayer/EigenLayerInterface.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/mocks/MockWETH.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/staking/VECStaking.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/libraries/Address.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/interface/IUniswapV2Router02.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/libraries/SafeMath.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/libraries/Counters.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/interface/IWETH.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/interface/IDistributor.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/interface/eigenlayer/IEigenLayerDelegationManager.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/mocks/MockLST.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/mocks/MockERC20.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/treasury/VectorTreasury.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/libraries/SafeERC20.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0
  • https://github.com/vectorreserve/vector-contracts/contracts/bonds/VectorBonding.sol at commit 6c92889621f6cc3e28b2b0487acd45b7859229e0

Part of Vector Reserve’s security record

Vector Reserve
Audits1 audit by 1 firmLast audit Feb 2024, by Quantstamp.
Critical findingsNo open critical findingsIn 1 report.
Open Vector Reserve’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us