Ribbon Finance Audit

OpenZeppelinFiles named in the report

Audit · firm’s term: audit

OpenZeppelin reviewed Ribbon Finance (Ribbon Finance Audit) on 9 Sep 2021: 23 findings, 1 critical; 18 marked fixed, 5 open.

1 critical finding, fixed
Open the reportOpen Ribbon Finance’s security record

Report hosted on blog.openzeppelin.com.

Trustblock does not review code.

Findings23

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical001
High001
Medium104
Low4012
Critical[C01] Instant withdrawals can disable essential vault functionalityFixed

The report gives no description here.

High[H01] Corruptible storage upgradeability patternFixed

The report gives no description here.

Medium[M01] Documentation issuesFixed

The report gives no description here.

Medium[M02] Rounds with no locked asset can lead to fee miscalculationsFixed

The report gives no description here.

Medium[M04] Inconsistent usage of reentrancy guardFixed

The report gives no description here.

Medium[M05] Vault fees are miscalculatedFixed

The report gives no description here.

Low[L01] Numerous uint types and resultant casts increase system complexityFixed

The report gives no description here.

Low[L02] Instances of unnecessarily convoluted control flowFixed

The report gives no description here.

Low[L03] Duplicated codeFixed

The report gives no description here.

Low[L04] Duplicated price per share calculationsFixed

The report gives no description here.

Show 8 more
Low[L05] Inconsistent upper bounds on optionAllocationPctFixed

The report gives no description here.

Low[L06] Lack of input validationFixed

The report gives no description here.

Low[L08] Mismatched lower bounds for vault feesFixed

The report gives no description here.

Low[L11] Identical constants defined independentlyFixed

The report gives no description here.

Low[L12] Solidity version varies, is not the most recentFixed

The report gives no description here.

Low[L14] Casting between types without overflow checksFixed

The report gives no description here.

Low[L15] Unused codeFixed

The report gives no description here.

Low[L16] Error-prone variable shadowingFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (17)

  • contracts/vaults/base/RibbonVault.sol
  • contracts/interfaces/GammaInterface.sol
  • contracts/interfaces/IERC20Detailed.sol
  • contracts/libraries/SupportsNonCompliantERC20.sol
  • contracts/interfaces/IWETH.sol
  • contracts/utils/StrikeSelection.sol
  • contracts/vaults/RibbonThetaVault.sol
  • contracts/vaults/RibbonDeltaVault.sol
  • contracts/libraries/GnosisAuction.sol
  • contracts/libraries/VaultLifecycle.sol
  • contracts/interfaces/IRibbon.sol
  • contracts/interfaces/IRibbonThetaVault.sol
  • contracts/libraries/ShareMath.sol
  • contracts/tests/GammaInterface.sol
  • contracts/interfaces/IGnosisAuction.sol
  • contracts/storage/OptionsVaultStorage.sol
  • contracts/libraries/Vault.sol

Part of Ribbon Finance’s security record

Ribbon Finance
Audits2 audits by 2 firmsLast audit Sep 2021, by OpenZeppelin.
Critical findingsNo open critical findingsAcross the 2 reports, 1 critical finding was reported. It is marked fixed by the firm that reported it.
Open Ribbon Finance’s security record

Security firm

OpenZeppelin

67 projects reviewed · 185 reports · latest Aug 2026

See OpenZeppelin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us