Gearbox contracts
Audit · firm’s term: security assessment
Sigma Prime reviewed Gearbox (Gearbox contracts) on 1 Apr 2022: 19 findings, 4 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings22
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 4 |
| High | 0 | 0 | 4 |
| Medium | 0 | 0 | 8 |
| Low | 0 | 0 | 3 |
CriticalDenial-of-Service (DoS) by Opening a Credit Account on Behalf of the CreditFacade ContractFixed
The report gives no description here.
CriticalIncorrect Parsing of Token Path Between Gearbox and UniswapFixed
The report gives no description here.
CriticalLiquidation Avoidance through Rejecting Native Ether TransfersFixed
The report gives no description here.
CriticalLiquidators Can Manipulate Pool’s Profit or Loss ValuesFixed
The report gives no description here.
Highapprove() Will Revert on Any Credit AccountFixed
The report gives no description here.
HighextraReward2 is Not Set in the constructor()Fixed
The report gives no description here.
HighIncomplete Implementation of Native Ether Transfers in LidoV1_WETHGatewayFixed
The report gives no description here.
HighLiquidation Avoidance by Front-Running liquidateCreditAccount() with Ownership TransferFixed
The report gives no description here.
MediumChainlink Oracle Data Feeds Lack ValidationFixed
The report gives no description here.
MediumFlashloan Protection Bypass Through Debt Increase and Account Closure Within The Same BlockFixed
The report gives no description here.
Show 9 more
MediumIncorrect Account Address Results in Missed RewardsFixed
The report gives no description here.
MediumIncorrect Construction of stakedPhantomTokenFixed
The report gives no description here.
MediumIncorrect Token Amounts Used in add_liquidity()Fixed
The report gives no description here.
MediumPremature Self-Destruct of PoolFactoryFixed
The report gives no description here.
MediumRetesting: claimRewards() Reverts UnexpectedlyFixed
The report gives no description here.
MediumTokens Passed in Incorrect Order when Calling fastCollateralCheck()Fixed
The report gives no description here.
LowCalls to calcBorrowRate() Can Fail if Variable is Set IncorrectlyFixed
The report gives no description here.
LowCredit Accounts Can Pass a Full Collateral Check and Also be LiquidatableFixed
The report gives no description here.
LowCurve Adapters May Fail to Enable Tokens if a Zeroised min_amounts Array is ProvidedFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Gearbox’s security record
GearboxSecurity firm
Sigma Prime36 projects reviewed · 78 reports · latest Aug 2026
See Sigma Prime’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us