Increment security review
Audit · firm’s term: security review
Pashov Audit Group reviewed Increment (Increment security review) on 22 Feb 2024: 26 findings, 1 critical; 18 marked fixed, 8 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings26
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 1 | 4 |
| Medium | 0 | 0 | 7 |
| Low | 0 | 7 | 6 |
CriticalRedeem period is less than intended down to 0Fixed
The report gives no description here.
HighGriefer can reset users' multiplier to 1Fixed
The report gives no description here.
HighStakedToken is vulnerable to share inflation attack via donationFixed
The report gives no description here.
HighStakers could lose extra rewards due to accrual on behalfFixed
The report gives no description here.
HighTrapped underlying tokens in the auctionFixed
The report gives no description here.
MediumaddStakedToken() can be griefedFixed
The report gives no description here.
MediumDisabling of cooldown during post- slash can be bypassedFixed
The report gives no description here.
MediumExtra rewards due to a malfunction with the _cumulativeRewardPerLpTokenFixed
The report gives no description here.
MediumFinal slashed amount could be much lower than expectedFixed
The report gives no description here.
MediumreturnFunds() can be frontrun to profit from an increase in share priceFixed
The report gives no description here.
Show 8 more
MediumStakers can activate cooldown during the pause and try to evade slashingFixed
The report gives no description here.
MediumUnauthorized rewardTokens in _marketWeightsByTokenFixed
The report gives no description here.
LowAdd sanity check that totalWeight equals 100% in PerpRewardDistributorFixed
The report gives no description here.
LowAttacker can grief whale stakers with dust transferFixed
The report gives no description here.
LowDisabling the cooldown period during post-slashing could affect the auctionFixed
The report gives no description here.
LowMalfunction within the auctions if there are multiple staked tokens with the same underlying tokenFixed
The report gives no description here.
LowThe AuctionModule.paymentToken could become indefinitely trapped in the SafetyModule contractFixed
The report gives no description here.
LowThe ongoing auctions may fail to close during the AuctionModule replacementFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Increment’s security record
IncrementSecurity firm
Pashov Audit Group30 projects reviewed · 53 reports · latest Jul 2026
See Pashov Audit Group’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us