Illuvium Yield Farming Rewards

QuantstampFiles named in the report

Audit

Quantstamp reviewed Illuvium (Illuvium Yield Farming Rewards) on 14 Aug 2021: 16 findings, 0 critical; 11 marked fixed, 4 acknowledged, 1 open.

No open critical findings
Open the reportOpen Illuvium’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings16

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium002
Low148
LowViolation Of Check-Effects-Interactions PatternOpen

The `_stake()` and `_unstake()` functions do not follow the [Check-Effects-Interactions pattern](https://docs.soliditylang.org/en/v0.8.1/security-considerations.html#re-entrancy), because the call to `_processVaultRewards()` function, makes a call to the the ILV token contract. <br><br> The same issue is also encountered in other functions such as `receiveVaultRewards()`. However, this is not an exhaustive list.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (44)

  • contracts/interfaces/ILockedPool.sol
  • contracts/utils/SafeMath.sol
  • contracts/mocks/FlashPoolMock.sol
  • contracts/locking_erc20/__LockingERC20.sol
  • contracts/utils/Address.sol
  • contracts/interfaces/IERC20Mintable.sol
  • contracts/utils/ERC20.sol
  • contracts/pools/IlluviumCorePool.sol
  • FlashPoolBase.sol
  • contracts/interfaces/IDisperse.sol
  • contracts/utils/Ownable.sol
  • contracts/token/IlluviumERC20.sol
  • contracts/pools/IlluviumLockedPool.sol
  • contracts/mocks/ERC20Mock.sol
  • contracts/interfaces/INFTClaimManager.sol
  • contracts/interfaces/IERC721.sol
  • contracts/mocks/__NopReceiver.sol
  • contracts/interfaces/IERC20.sol
  • contracts/interfaces/IVaultReceiver.sol
  • contracts/utils/SafeERC20.sol
  • contracts/locking_erc20/LockingERC20.sol
  • contracts/interfaces/IWETH.sol
  • contracts/pools/IlluviumVault.sol
  • contracts/mocks/__IlluviumERC20.sol
  • contracts/pools/IlluviumPoolBase.sol
  • contracts/locking_erc20/__NopLockingListener.sol
  • contracts/mocks/TokenLockingMock.sol
  • contracts/token/ERC721Receiver.sol
  • contracts/Migrations.sol
  • contracts/interfaces/ICorePool.sol
  • contracts/pools/TokenLocking.sol
  • contracts/mocks/PoolFactoryMock.sol
  • contracts/utils/AccessControl.sol
  • contracts/pools/IlluviumPoolFactory.sol
  • contracts/token/ERC20Receiver.sol
  • contracts/interfaces/IPool.sol
  • contracts/mocks/LockedPoolMock.sol
  • contracts/interfaces/IERC1155.sol
  • contracts/mocks/CorePoolMock.sol
  • contracts/locking_erc20/LockingListener.sol
  • FlashPoolV2.sol
  • contracts/utils/AddressUtils.sol
  • contracts/pools/IlluviumFlashPool.sol
  • contracts/token/EscrowedIlluviumERC20.sol

Part of Illuvium’s security record

Illuvium
Audits6 audits by 4 firmsLast audit Oct 2025, by Cyfrin.
Critical findingsNo open critical findingsAcross 6 reports.
Open Illuvium’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us