Derive security review
Audit · firm’s term: security review
Sigma Prime reviewed Derive (Derive security review) on 1 Sep 2024: 16 findings, 4 critical; 11 marked fixed, 5 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings16
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 4 |
| High | 0 | 0 | 2 |
| Medium | 0 | 2 | 2 |
| Low | 0 | 3 | 3 |
CriticalBids Can Be Blocked By Sending Option To LiquidatorFixed
The report gives no description here.
CriticalDenial-of-Service (DoS) During Manager Health Checks Affects Liqui- dationsFixed
The report gives no description here.
CriticalFunds can be Drained from the Protocol by Liquidating an Account Dur- ing an Asset TransferFixed
The report gives no description here.
CriticalLiquidator Can Bid With Insufficient CashFixed
The report gives no description here.
HighAccount Can Be Created With Arbitrary Manager AddressFixed
The report gives no description here.
HighFully Liquidated Auctions Cannot Be TerminatedFixed
The report gives no description here.
MediumAssets Can Be Transferred After Auction StartedFixed
The report gives no description here.
MediumSession Key Deregistration Cooldowns can be AvoidedFixed
The report gives no description here.
LowDust Asset Amounts Can Amplify Gas CostsFixed
The report gives no description here.
LowId Can Overflow In Loop Causing DOSFixed
The report gives no description here.
Show 1 more
LowPotential DoS Risk In Derive Protocol Due To Unbounded LoopFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Derive’s security record
DeriveSecurity firm
Sigma Prime16 projects reviewed · 37 reports · latest Aug 2026
See Sigma Prime’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us