For Trader Joe (Core v2.

Paladin31 Mar 20249 addresses on Avalanche, BNB Chain and Arbitrum

Paladin reviewed Trader Joe (For Trader Joe (Core v2.) on 31 Mar 2024: 26 findings, 0 critical; 13 marked fixed, 13 acknowledged.

No open critical findings

Open the report Open Trader Joe’s security record

Report stored on IPFS. Content hash QmeKcJaqifx72gatS8NZfUu6kGi9XXBXFJVwrPcWNZaeRL

Trustblock does not review code.

Findings26

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	2
Medium	0	2	2
Low	0	10	9

HighGovernance Privilege: Hook modification privilegeAcknowledged

The report gives no description here.

MediumContracts without fallback functions might not accept the native tokenAcknowledged

The report gives no description here.

MediumUsers may grief rewards by abusing known attack-vector to temporarily DoS swapsAcknowledged

The report gives no description here.

LowBroken MasterChef prevents state changes within LBPairAcknowledged

The report gives no description here.

LowDelta bins are not set upon initializationAcknowledged

The report gives no description here.

LowLack of address(0) check after cloningAcknowledged

The report gives no description here.

LowLogic is not compatible with extraRewarder from Merchant Moe MasterChefAcknowledged

The report gives no description here.

LowOracle is still vulnerable to manipulationAcknowledged

The report gives no description here.

LowRemoval of ExtraRewarder will prevent users from claiming rewardsAcknowledged

The report gives no description here.

LowRewards are distributed retroactively if the active range has no liquidity (BaseRewarder)Acknowledged

The report gives no description here.

Show 3 more

LowSophisticated but unrealistic exploit allows for DoS in the pair under extreme situationsAcknowledged

The report gives no description here.

LowUnfair reward distribution due to using liquidity to determine pro- rata amountAcknowledged

The report gives no description here.

LowUsers can only claim as long as the rewarder is linkedAcknowledged

The report gives no description here.

Contracts in scope3

Address	Chain	Source code
0xafb85a12babfafabfe1a518594492d5a830e782a	Chain: Avalanche	Source code: Verified source
0xa6630671775c4ea2743840f9a5016dcf2a104054	Chain: Avalanche	Source code: Verified source
0xf6863db7323aac43fe8aef0b3ef63aa6b32ddb3b	Chain: Avalanche	Source code: Verified source

Part of Trader Joe’s security record

Trader Joe

Audits12 audits by 3 firmsLast audit Mar 2024, by Paladin.

Critical findingsNo open critical findingsAcross 12 reports.

Open Trader Joe’s security record

Security firm

Paladin

176 projects reviewed · 241 reports · latest Apr 2025

See Paladin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.