Audit Report

Paladin17 Apr 202338 addresses on Polygon (POS) and Arbitrum

Paladin reviewed Slingshot (Audit Report) on 17 Apr 2023: 54 findings, 0 critical; 38 marked fixed, 8 acknowledged, 8 open.

No open critical findings

Open the report Open Slingshot’s security record

Report hosted on paladinsec.co.

Trustblock does not review code.

Findings54

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	1	0	2
Medium	1	1	3
Low	6	7	33

HighcreateLockFor lacks sufficient safeguards allowing an exploiter to drain any approved governance tokens from any walletFixed

The report gives no description here.

HighideaSet logic is significantly flawed and will cause all votes to eventually always revertFixed

The report gives no description here.

Medium_updateRewardAmount allocates too much funds to future periodsFixed

The report gives no description here.

Mediumclaim() will frequently revert as claimRewardForEpochs() will fail at claiming rewards for an active epochFixed

The report gives no description here.

Mediumpause does not correctly update the stored epoch within the epochs list, causing this list to potentially become outdatedFixed

The report gives no description here.

Low_claimRewardForEpoch does not internally check against double claimingFixed

The report gives no description here.

Low_updateRewardAmount can revert starting from epoch 52Fixed

The report gives no description here.

Lowclaim might start to revert implicitly if the vestingPeriod is ever lengthenedFixed

The report gives no description here.

LowCompleteness: Codebase does not handle return values of ERC20 transfersFixed

The report gives no description here.

LowfeeToken can be made immutableFixed

The report gives no description here.

Show 10 more

LowGas optimizationFixed

The report gives no description here.

LowgetIdeaInfo and getProposalFee can be made externalFixed

The report gives no description here.

LowIdentical ideas can be published multiple timesFixed

The report gives no description here.

LowImplicit super calls when multiple parent contracts implement the function might be confusing to reviewersFixed

The report gives no description here.

LowLack of validationFixed

The report gives no description here.

LowMINTIME validation should occur after the unlock_time is rounded downFixed

The report gives no description here.

LowNot all user functions are protected with a reentrancy guardFixed

The report gives no description here.

LowrunwayLength can be made constantFixed

The report gives no description here.

Lowset_smart_wallet_checker ERC-165 check is insufficientFixed

The report gives no description here.

LowStyle: Inconsistent usage of require and if/revert patternsFixed

The report gives no description here.

Show 10 more

LowStyle: publishIdea does not adhere to checks-effects-interactionsFixed

The report gives no description here.

LowStyle: Usage of address type for contracts with an actual interfaceFixed

The report gives no description here.

LowThe ideator of the idea with ID = 1 is set to a non-zero accountFixed

The report gives no description here.

Lowtoken and veContract can be made immutableFixed

The report gives no description here.

Lowtoken can be made immutableFixed

The report gives no description here.

Lowtoken can be made immutableFixed

The report gives no description here.

Lowtoken can be made immutableFixed

The report gives no description here.

Lowtoken can be made immutableFixed

The report gives no description here.

Lowtreasury can be made immutableFixed

The report gives no description here.

LowTypographical errorFixed

The report gives no description here.

Show 8 more

LowTypographical errorFixed

The report gives no description here.

LowTypographical errorsFixed

The report gives no description here.

LowTypographical errorsFixed

The report gives no description here.

LowTypographical errorsFixed

The report gives no description here.

LowUnused components: _getThisEpoch, ReentrancyGuard.sol, veContractFixed

The report gives no description here.

LowUnused import: IEpochManager.solFixed

The report gives no description here.

LowUsers might pay an unexpectedly high fee if governance changes the proposal fee while their transaction is pendingFixed

The report gives no description here.

LowvotingPowerThreshold lacks proper validationFixed

The report gives no description here.

Contracts in scope38

Address	Chain	Source code
0x20491b614c25ab7d0715fdfe566303b241b67097	Chain: Arbitrum	Source code: Verified source
0x7233d650375fb1eb2f9fe4f5733b14d514231f3f	Chain: Polygon (POS)	Source code: Verified source
0xcb48323566d5bc0391af2ae0c98bf88af04268a3	Chain: Polygon (POS)	Source code: Verified source
0x6dbea2463fdf3da7a53e87e774ac8db414529a31	Chain: Arbitrum	Source code: Verified source
0x4451f69edf51b1448898469b708956cffb2e7164	Chain: Arbitrum	Source code: Verified source
0xd2bda552055728e38acabe961af82a866adaf548	Chain: Arbitrum	Source code: Verified source
0x3d7656a11515fd7bb3057fe2988374379a7404d1	Chain: Arbitrum	Source code: Verified source
0x586d551d3f86c63d1d7a88af7252db4579513f3e	Chain: Polygon (POS)	Source code: Verified source
0x586d551d3f86c63d1d7a88af7252db4579513f3e	Chain: Arbitrum	Source code: Verified source
0xc23727dfea6c9ac55e8df6c40f779e0caf49324e	Chain: Polygon (POS)	Source code: Verified source

Show the other 28 addresses

Address	Chain	Source code
0x295913032633ade1891f25b975ac65025ad3eb38	Chain: Arbitrum
0xcb48323566d5bc0391af2ae0c98bf88af04268a3	Chain: Arbitrum	Source code: Verified source
0x0a574171411bbfc21d2bbfdba324f6bbb3374ec4	Chain: Arbitrum	Source code: Verified source
0xf39d5825207e5464221eb65100ef1a6434ceef3d	Chain: Arbitrum	Source code: Verified source. Powered by Etherscan.io APIs
0x5364ec7fb4ddfe662009c4b6e2668d5a8a61d658	Chain: Polygon (POS)	Source code: Verified source
0x875b2b5f1b83b50e0215fe7bb84e750b637b64d8	Chain: Arbitrum	Source code: Verified source
0xc23727dfea6c9ac55e8df6c40f779e0caf49324e	Chain: Arbitrum	Source code: Verified source
0xad9b49024c62be0c7f16a4aeac35077f1ce85210	Chain: Polygon (POS)	Source code: Verified source
0x6dbea2463fdf3da7a53e87e774ac8db414529a31	Chain: Polygon (POS)	Source code: Verified source
0xd82dbba5f6216c27a76af3c1b93c6d044999bae0	Chain: Arbitrum	Source code: Verified source
0xd2bda552055728e38acabe961af82a866adaf548	Chain: Polygon (POS)	Source code: Verified source
0xad9b49024c62be0c7f16a4aeac35077f1ce85210	Chain: Arbitrum	Source code: Verified source
0xf5dea604b100ca012c395ca00e731429e11001d3	Chain: Arbitrum	Source code: Verified source
0xfc9fa9771145fbb98d15c8c2cc94b837a56d554c	Chain: Polygon (POS)	Source code: Verified source
0xfc9fa9771145fbb98d15c8c2cc94b837a56d554c	Chain: Arbitrum	Source code: Verified source
0xf5dea604b100ca012c395ca00e731429e11001d3	Chain: Polygon (POS)	Source code: Verified source
0xf39d5825207e5464221eb65100ef1a6434ceef3d	Chain: Polygon (POS)	Source code: Verified source
0x295913032633ade1891f25b975ac65025ad3eb38	Chain: Polygon (POS)	Source code: Verified source
0xd82dbba5f6216c27a76af3c1b93c6d044999bae0	Chain: Polygon (POS)	Source code: Verified source
0x80e0dbaef35b7fa5eb6ac6735ce68f82583196fc	Chain: Arbitrum	Source code: Verified source
0x80e0dbaef35b7fa5eb6ac6735ce68f82583196fc	Chain: Polygon (POS)	Source code: Verified source
0x4451f69edf51b1448898469b708956cffb2e7164	Chain: Polygon (POS)	Source code: Verified source
0x0a574171411bbfc21d2bbfdba324f6bbb3374ec4	Chain: Polygon (POS)	Source code: Verified source
0x20491b614c25ab7d0715fdfe566303b241b67097	Chain: Polygon (POS)	Source code: Verified source
0x3d7656a11515fd7bb3057fe2988374379a7404d1	Chain: Polygon (POS)	Source code: Verified source
0x875b2b5f1b83b50e0215fe7bb84e750b637b64d8	Chain: Polygon (POS)	Source code: Verified source
0x5364ec7fb4ddfe662009c4b6e2668d5a8a61d658	Chain: Arbitrum	Source code: Verified source
0x7233d650375fb1eb2f9fe4f5733b14d514231f3f	Chain: Arbitrum	Source code: Verified source

Part of Slingshot’s security record

Slingshot

Audits2 audits by 1 firmLast audit Dec 2024, by Paladin.

Critical findingsNo open critical findingsAcross 2 reports.

Open Slingshot’s security record

Security firm

Paladin

176 projects reviewed · 241 reports · latest Apr 2025

See Paladin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.