Spectra security review
Audit · firm’s term: security review
Pashov Audit Group reviewed Spectra (Spectra security review) on 2 Mar 2024: 18 findings, 0 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings18
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 0 | 15 |
MediumAttack surface in the middle of the execute()Fixed
The report gives no description here.
MediumCode doesn't work with fee on transfer tokensFixed
The report gives no description here.
MediumTRANSFER_FROM_WITH_PERMIT command is vulnerable to DOS via frontrunningFixed
The report gives no description here.
Low_dispatch() should ignore the command when _resolveTokenValue() returns 0Fixed
The report gives no description here.
LowCalling Router.onFlashLoan() when msgSender is address(this)Fixed
The report gives no description here.
LowDispatcher::_dispatchPreviewRate may incorrectly calculate the rateFixed
The report gives no description here.
LowFunction _addInitialLiquidity() doesn't have slippage protectionFixed
The report gives no description here.
LowIn function spotExchangeRate() code should use CURVE_DECIMALSFixed
The report gives no description here.
LowIncomplete permission setting in deployAll() affects reward claimingFixed
The report gives no description here.
LowInefficient ERC20 allowance handlingFixed
The report gives no description here.
Show 8 more
LowInlined duplicate _resolveTokenValue logicFixed
The report gives no description here.
LowOff-by-one error in max number of iterations of getDx()Fixed
The report gives no description here.
LowRouter.execute() does not need to be payableFixed
The report gives no description here.
LowRouter.msgSender can be reset to 0 while executing commandsFixed
The report gives no description here.
LowThe Factory.registry may be modified during the deploymentFixed
The report gives no description here.
LowUnnecessary Ownable2StepUpgradeable inheritance in RouterFixed
The report gives no description here.
LowUnnecessary usage of approveFixed
The report gives no description here.
LowUnused imports in several filesFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Spectra’s security record
SpectraSecurity firm
Pashov Audit Group86 projects reviewed · 165 reports · latest Aug 2026
See Pashov Audit Group’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us