Napier security review
Audit · firm’s term: security review
Pashov Audit Group reviewed Napier (Napier security review) on 23 Oct 2025: 18 findings, 0 critical; 11 marked fixed, 7 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings18
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 7 | 10 |
MediumUpdating oracle with post-swap lnImpliedRate allows TWAP manipulationFixed
The report gives no description here.
LowaddLiquidity refunds may return shares, potentially causing integration issues.Fixed
The report gives no description here.
LowHookSwap event shows wrong lp fee amountFixed
The report gives no description here.
LowinitialAnchor not validated to be >= IWADFixed
The report gives no description here.
LowMissing event emission for privileged functionFixed
The report gives no description here.
LowMissing read-only reentrancy protection in TokiHook.getTotalBalances()Fixed
The report gives no description here.
LowPrincipalToken expiry and pause checks missing in quote functionsFixed
The report gives no description here.
Lowsalt inefficiency in quoteCreateAndAddLiquidity() mismatches addressFixed
The report gives no description here.
LowStruct with unused fields in TokiQuoterFixed
The report gives no description here.
LowTokiOracle can benefit from further documentationFixed
The report gives no description here.
Show 1 more
Lowv4-integration.md docs should be updatedFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Napier’s security record
NapierSecurity firm
Pashov Audit Group86 projects reviewed · 165 reports · latest Aug 2026
See Pashov Audit Group’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us