Audit Report
Paladin reviewed MAXIMUS (Audit Report) on 23 Dec 2021: 53 findings, 0 critical; 37 marked fixed, 15 acknowledged, 1 open.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings53
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 6 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 15 | 28 |
High_harvest deposits the whole JOE contract balance which allows an exploiter to mint and dump huge amounts of MAXIMUS tokens similar to exploits PancakeBunny has witnessed in the pastFixed
The report gives no description here.
HighThe addLiquidity call to create an LP pair allows for value inflation exploits which allow an exploiter to mint and dump Maximus with profitFixed
The report gives no description here.
HighThe system design, which is based on PancakeBunny, is extremely brittle with regards to native token securityFixed
The report gives no description here.
HighWAVAX.withdraw will fail as the contract is upgradeableFixed
The report gives no description here.
HighwithdrawUnderlying and getReward round shares amount down allowing for potentially severe exploits that could lead to loss of all staked fundsFixed
The report gives no description here.
HighwithdrawUnderlying and getReward round shares amount down allowing for potentially severe exploits that could lead to loss of all staked fundsFixed
The report gives no description here.
MediumReward mechanism can cause withdrawals to be permanently blocked if governance wrongly configures the vaultsFixed
The report gives no description here.
MediumVault does not support staking JOE token, reflective tokens and tokens that allow for reentrancyFixed
The report gives no description here.
MediumVault does not support staking JOE token, reflective tokens and tokens that allow for reentrancyFixed
The report gives no description here.
Low_depositStakingToken and _withdrawStakingToken always return zeroFixed
The report gives no description here.
Show 10 more
Low_vaultList is privateFixed
The report gives no description here.
LowConstructor sets constant parameters which are outdatedFixed
The report gives no description here.
LowDepositing right before a harvest could allow for slight arbitrageFixed
The report gives no description here.
LowGas optimization: canMint check is redundantFixed
The report gives no description here.
LowGas optimization: price of Maximus can be cachedFixed
The report gives no description here.
LowGas optimization: Unnecessary precision multiplicationFixed
The report gives no description here.
LowGovernance functions unnecessarily wrap addresses to IERC20 while they can just accept IERC20 as the argumentFixed
The report gives no description here.
LowGovernance privilege: Lack of validation on setWithdrawalFeeFreePeriod could allow governance to force the 5% withdrawal fee on all stakersFixed
The report gives no description here.
LowGriefing exploit: migrate allows users to deposit into another user resetting their withdrawal fee timerFixed
The report gives no description here.
LowLack of events for addVault, updateVault, setMinter, setMaximusPerSec and recoverTokenFixed
The report gives no description here.
Show 10 more
LowLack of events for setKeeper, setMinter and setMaximusChefFixed
The report gives no description here.
LowLack of events for setRewardsDistributionFixed
The report gives no description here.
LowLack of events for transferMaximusOwner, setWithdrawalFee, setPerformanceFee, setWithdrawalFeeFreePeriod, setMinter, setMaximusChef, setFloatingRateEmission, setFREThresholdFixed
The report gives no description here.
LowLack of origin parameter in staked eventFixed
The report gives no description here.
LowMaximusChef is unusedFixed
The report gives no description here.
LowmintFor returns early if maximusAVAXAmount is zero, causing the user to not receive their Maximus rewardFixed
The report gives no description here.
LowOnly supports Maximus as staking token and Maximus/WAVAX LP as rewards tokenFixed
The report gives no description here.
LowRounding vulnerability to tokens with a very large supply can cause large supply tokens to receive zero emissionsFixed
The report gives no description here.
LowSupposedly has JOE as the staking token yet the balances are denominated in xJOEFixed
The report gives no description here.
LowTypographical errorFixed
The report gives no description here.
Show 7 more
LowTypographical errorFixed
The report gives no description here.
LowUnnecessary comparison to trueFixed
The report gives no description here.
LowUsage of chained initializersFixed
The report gives no description here.
LowUsage of raw addition instead to SafeMathFixed
The report gives no description here.
LowWhitelistUpgradeable might need unchanged initializerFixed
The report gives no description here.
LowWithdrawn event might emit wrong third parameterFixed
The report gives no description here.
LowZap functions will malfunction for reflective tokensFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of MAXIMUS’s security record
MAXIMUSSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us