Audit Report
Paladin reviewed Vesq Presale (Audit Report) on 10 Dec 2021: 56 findings, 0 critical; 46 marked fixed, 7 acknowledged, 3 open.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings56
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 0 | 2 |
| Low | 3 | 7 | 41 |
HighGov Privilege: Governance can change crucial aspects of the protocol to potentially drain the contracts of all supplied tokensFixed
The report gives no description here.
HighStaked amount is relocked on subsequent stakes, even if the stake is made by third-parties allowing for targeted Denial of ServiceFixed
The report gives no description here.
HighVested amount is relocked on deposit, even if the deposit is made by third-parties allowing for targeted Denial of ServiceFixed
The report gives no description here.
MediumDoes not support LP pairs where the second currency has less than 9 decimalsFixed
The report gives no description here.
MediumThe last owner can be reclaimed across multiple contractsFixed
The report gives no description here.
Low_burnFrom is marked as publicFixed
The report gives no description here.
LowAdding a token as both a liquidity and reserve token would cause it to be double counted in the treasury valueFixed
The report gives no description here.
LowAdjustment target is never reachedFixed
The report gives no description here.
LowAdjustment target is never reachedFixed
The report gives no description here.
LowAdjustments are not reset when recipient is removedFixed
The report gives no description here.
Show 10 more
LowbondPriceInUSD is denominated in the decimals of the other token in the LP and might not be correct for non stablecoin LPsFixed
The report gives no description here.
LowContract could theoretically run out of VSQFixed
The report gives no description here.
LowContract does not work with a zero vestingTermFixed
The report gives no description here.
LowDeposit is vulnerable to reentrancy if the principle has a reentrancy vectorFixed
The report gives no description here.
LowDOMAIN_SEPARATOR can be made immutableFixed
The report gives no description here.
LowGas optimization: Usage of decimals as a precision multiplierFixed
The report gives no description here.
LowInconsistency: Unused mint function emits an event from address(this) while the mint logic during initialization emits an event from the zero addressFixed
The report gives no description here.
LowInfrequent rebases incentivize malicious parties to strategically (re)order transactions for arbitrage and steal all rebased tokens off the LP pairsFixed
The report gives no description here.
LowinitializeBondTerms has no validationFixed
The report gives no description here.
LowLack of events for various functionsFixed
The report gives no description here.
Show 10 more
LowLack of safeTransfer usage within incurDebtFixed
The report gives no description here.
LowLack of validationFixed
The report gives no description here.
LowLock logic might be wrongly definedFixed
The report gives no description here.
LowManage will always do an excessReserve check even if the token is not within the liquidity or reserves tokensFixed
The report gives no description here.
LowMarkdown will misbehave if an LP with two non-VSQ tokens is providedFixed
The report gives no description here.
LowNew owner variable is privateFixed
The report gives no description here.
Lowpermit can be frontrun and cause denial of serviceFixed
The report gives no description here.
LowPhishing: Frontend could trick users into sending too much MATIC for depositsFixed
The report gives no description here.
LowpriceFeed is internalFixed
The report gives no description here.
LowRebases can be arbitraged/frontranFixed
The report gives no description here.
Show 10 more
LowrepayDebtWithVSQ has inconsistent privilege requirements which allows for slight privilege escalationFixed
The report gives no description here.
LowReserve value mechanism could cause withdrawals and other operations to temporarily failFixed
The report gives no description here.
LowStandardBondingCalculator can only value pairs in which the two tokens have equal “value”Fixed
The report gives no description here.
LowswapData can be denoted as calldata throughout the contractFixed
The report gives no description here.
LowThe contracts become unusable in the year 2106Fixed
The report gives no description here.
LowThe contracts do not work with reflective tokensFixed
The report gives no description here.
LowThe maximum debt can be exceeded by at most maxPayoutFixed
The report gives no description here.
LowThe protocol will likely malfunction if ChainLink feeds for MATIC will be different than 8 decimalsFixed
The report gives no description here.
LowTransactionless approval permit mechanism still references zero swapFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
Show 6 more
LowUnbounded gas usage due to extensive for-loop usageFixed
The report gives no description here.
LowUnnecessary comparison to true on withdraw functionFixed
The report gives no description here.
LowUnused variables/dependencies throughout the contractsFixed
The report gives no description here.
LowUsage of transferFrom/transfer instead of safeTransferFrom/ safeTransferFixed
The report gives no description here.
LowVarious functions can be made externalFixed
The report gives no description here.
LowVault can be set to the zero addressFixed
The report gives no description here.
Contracts in scope15
| Address | Chain | Source code |
|---|---|---|
| 0x2f3e9e54bd4513d1b49a6d915f9a83310638cfc2 | Chain: Polygon (POS) | Source code: Verified source |
| 0xbb0fdc2fe6d3ceb6bf76cc955173a07edbf57494 | Chain: Polygon (POS) | Source code: Verified source |
| 0xabe372dcfb8800b3cde30f1d6666401c765f2f3b | Chain: Polygon (POS) | Source code: Verified source |
| 0xf4acbe9de1fae931c5a67115184069474d4fadad | Chain: Polygon (POS) | Source code: Verified source |
| 0x8ab125d6d6ea1743e53ca79595046f2a0c76a551 | Chain: Polygon (POS) | Source code: Verified source |
| 0x9fd78920cdbe6f365a557cec282cc88152e35670 | Chain: Polygon (POS) | Source code: Verified source |
| 0x6fd68930ec828ec5906b0fdec686f3f459c08d1a | Chain: Polygon (POS) | |
| 0xe33e7247bdf5fdeb6705e820f3f26823ea294f13 | Chain: Polygon (POS) | Source code: Verified source |
| 0x5aec30afe641ebe8789d8b21223f6d2c74f6fe2c | Chain: Polygon (POS) | Source code: Verified source |
| 0x29f1e986fca02b7e54138c04c4f503dddd250558 | Chain: Polygon (POS) | Source code: Verified source |
Show the other 5 addresses
| Address | Chain | Source code |
|---|---|---|
| 0xfeeadb0798ef580b1394eb38659cf85cc25d43e4 | Chain: Polygon (POS) | Source code: Verified source |
| 0x8c7290399cecbbbf31e471951cc4c2ce91f5073c | Chain: Polygon (POS) | Source code: Verified source |
| 0x2d7c40cd0228264ae5a73f01bc54fa13c4476da1 | Chain: Polygon (POS) | |
| 0x05b33f816d2c0c2d20f0777a75ad549df05bf24d | Chain: Polygon (POS) | Source code: Verified source |
| 0x493fdb9ddfd51873a878494b0e4d858d6dec57e9 | Chain: Polygon (POS) | Source code: Verified source |
Part of Vesq Presale’s security record
Vesq PresaleSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us