Fathom DAO

OXORIORepository at commit 5e9f3a2

Audit

OXORIO reviewed Fathom (Fathom DAO) on 18 Jan 2023: 75 findings, 8 critical; 63 marked fixed, 12 acknowledged.

8 critical findings, fixed
Open the reportOpen Fathom’s security record

Report hosted on audits.oxor.io.

Trustblock does not review code.

Findings75

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical008
High0125
Medium0514
Low0616
CriticalAdding a new owner doesn't change necessary amount of signatures in MultiSigWalletFixed

The report gives no description here.

CriticalCalling the updateConfig function may block the work of the StakingHandlers contractFixed

The report gives no description here.

CriticalChanging the timelock address may cause re-execution of the proposals in GovernorTimelockControlFixed

The report gives no description here.

CriticalRemoving owner without revokeConfirmation transaction in MultiSigWalletFixed

The report gives no description here.

CriticalThe initVault and initAdminAndOperator functions can be initialized from any address in the VaultPackage contractFixed

The report gives no description here.

CriticalThere is no check that stream is active in the StakingHandler contractFixed

The report gives no description here.

CriticalThere is no function that implements the _cancel proposal in MainTokenGovernorFixed

The report gives no description here.

CriticalThere's no owners array length validation in the constructor of MultiSigWalletFixed

The report gives no description here.

HighAdmin role can be revoked forever by mistake in VMainTokenFixed

The report gives no description here.

HighCalling initializeStaking in the StakingHandlers contract does not allocate rewards for MAIN_STREAM in VaultPackageFixed

The report gives no description here.

Show 10 more
HighGovernance can delete TimelockAdmin and the contract will lose its control in TimelockControllerFixed

The report gives no description here.

HighIn MultiSigWallet there's no parameter defining minimum amount of signaturesFixed

The report gives no description here.

HighIt is possible for attacker to create active locks to force users to reach the lock limit in StakingHandlersFixed

The report gives no description here.

HighIt is possible to set a null address in GovernorTimelockControl when updating timelockFixed

The report gives no description here.

HighMINTER_ROLE and WHITELISTER_ROLE have the same value in the VMainTokenFixed

The report gives no description here.

HighPenalty can be bigger than stake in the StakingInternalsFixed

The report gives no description here.

HighprohibitedEarlyWithdraw is not set to false for lockid after unlocking in StakingHandlersFixed

The report gives no description here.

HighShare weight drop formula is incorrect in StakingInternalsFixed

The report gives no description here.

HighThere is a DoS possibility when calling updateVault in the StakingHandlers contractFixed

The report gives no description here.

HighThere is a possibility for a manager to remove all streams in order to steal all pending rewards in StakingHandlersFixed

The report gives no description here.

Show 10 more
HighThere is no emergency shutdown mode in GovernorFixed

The report gives no description here.

HighThere is no emergency suspension of the rewards payment in the VaultPackage contractFixed

The report gives no description here.

HighThere is no option to migrate to another contract in the VaultPackage contractFixed

The report gives no description here.

HighThere is no possibility to transfer standard ERC20 tokens from the Governance balance in MainTokenGovernorFixed

The report gives no description here.

HighThere is no possibility to update multisig in GovernorFixed

The report gives no description here.

HighThere is no validation for maxTargets when executing in GovernorFixed

The report gives no description here.

HighThere is no validation for null values for newQuorumNumerator in GovernorVotesQuorumFractionFixed

The report gives no description here.

HighTokens that get into the VaultPackage balance can be used to withdraw rewards in the contract StakingHandlerFixed

The report gives no description here.

HighTransaction does not have a lifetime parameter in MultiSigWalletFixed

The report gives no description here.

HighTransaction should be marked as executed if the call failsFixed

The report gives no description here.

Show 10 more
HighUnsafe use of the transfer and transferFrom functions in StakingHandlers and VaultPackageFixed

The report gives no description here.

HighUpdating rpsDuringLastClaimForLock for inactive stream in the StakingInternals contractFixed

The report gives no description here.

HighWhen MINTER_ROLE is added to VMainToken, the isWhiteListed list does not updateFixed

The report gives no description here.

MediumA missing check that tokens are on the balance when calling the payRewards function in the VaultPackage contractFixed

The report gives no description here.

MediumconfirmProposal is possible for both active and inactive proposals in GovernorFixed

The report gives no description here.

MediumIncorrect processing of contract modifiers Initializable in the StakingHanders contractFixed

The report gives no description here.

MediumIt is possible for any user to call createStream in the StakingHandlers contractFixed

The report gives no description here.

MediumIt is possible to remove tokens that are used by another contract in VaultPackageFixed

The report gives no description here.

MediumMissing validation, that the bytecode of address _to did not change while running a transaction in MultiSigWalletFixed

The report gives no description here.

MediumNo parameter check when adding transaction in MultiSigWalletFixed

The report gives no description here.

Show 10 more
MediumPossible overflow with calculationsFixed

The report gives no description here.

MediumThere is no check for the msg.value value available for execution in Governor and TimelockControllerFixed

The report gives no description here.

MediumThere is no check for zero in GovernorSettings._setProposalThresholdFixed

The report gives no description here.

MediumThere is no check for zero value for _token, _multiSig and _timelock in Governor, GovernorTimelockControl, MainTokenGovernorFixed

The report gives no description here.

MediumThere is no limit on the number of proposals for one proposer in GovernorFixed

The report gives no description here.

MediumThere is no time limit for executing proposal in GovernorFixed

The report gives no description here.

MediumThere's no ETH balance validation when adding a non-zero transaction _value in MultiSigWalletFixed

The report gives no description here.

Low_minDelay can be set to zero in TimelockControllerFixed

The report gives no description here.

LowIncorrect status check in execute function in GovernorFixed

The report gives no description here.

LowMisleading check (scheduleTimeLength > 0) in the RewardsCalculatorFixed

The report gives no description here.

Show 10 more
LowNon-optimal packing of the Transaction structure in MultiSigWalletFixed

The report gives no description here.

LowNon-optimal storage layout for Stream struct in StakingStructsFixed

The report gives no description here.

LowRedundant check for maxDepositAmount > 0 in RewardsCalculatorFixed

The report gives no description here.

LowThe addSupportedToken and removeSupportedToken calls have an redundant pausable modifier in the VaultPackage contractFixed

The report gives no description here.

LowThere are no checks that admin, proposers and executors are not zero addresses in TimelockControllerFixed

The report gives no description here.

LowThere is a redundant initialized check in VMainTokenFixed

The report gives no description here.

LowThere is a typo in a comment in StakingInternalsFixed

The report gives no description here.

LowThere is redundant code in the VMainToken contractFixed

The report gives no description here.

LowThere's no logging of reverted transactions in MultiSigWalletFixed

The report gives no description here.

LowUnused constant ONE_MONTH in StakingGettersHelperFixed

The report gives no description here.

Show 3 more
LowUnused import of ReentracyGuard in StakingHandlersFixed

The report gives no description here.

LowUnused import of StakingStructs in StakingStorageFixed

The report gives no description here.

LowСustom initializer modifier is used instead of one from OpenZeppelinFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (171)

  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/vault/packages/VaultPackage.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/access/AccessControl.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/structs/Counters.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/vault/packages/VaultPackage.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/StakingStorage.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/interfaces/IStaking.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/ERC20/extensions/IERC20Metadata.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/helpers/IStakingHelper.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/interfaces/IGovernor.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/proxy/StakingProxy.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/packages/StakingInternals.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/token-factory/interfaces/IERC20Factory.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/token-factory/ERC20Factory.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/MainTokenGovernor.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/ERC20/ERC20.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/security/IAdminPausable.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/Strings.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/interfaces/IStakingGetter.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/MainToken.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/extensions/GovernorVotesQuorumFraction.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/Governor.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/extensions/GovernorVotes.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/ERC20/extensions/IERC20Permit.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/packages/StakingInternals.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/access/IAccessControl.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/proxy/StakingProxyAdmin.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/cryptography/EIP712.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/MainTokenGovernor.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/ERC20/extensions/ERC20Votes.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/proxy/VaultProxyAdmin.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/security/AdminPausable.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/Address.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/GovernorStructs.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/Context.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/staking/upgrades/StakingUpgrade.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/interfaces/IStakingGetter.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/token-timelock/interfaces/ITokenTimelockFactory.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/vault/interfaces/IVault.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/packages/StakingHandler.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/IBox.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/library/StakingLibrary.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/math/Math.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/proxy/StakingProxy.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/staking/upgrades/VaultUpgrade.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/TimelockController.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/proxy/VaultProxy.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/extensions/GovernorSettings.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/extensions/IGovernorTimelock.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/Strings.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/staking/upgrades/StakingUpgrade.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/ERC20/extensions/IERC20Metadata.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/proxy/transparent/TransparentUpgradeableProxy.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/ERC20/extensions/IERC20Permit.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/packages/RewardsInternals.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/SafeERC20.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/interfaces/IStakingEvents.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/extensions/IVotes.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/VMainToken.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/access/AccessControl.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/Governor.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/structs/DoubleEndedQueue.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/interfaces/ITimelockController.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/token-timelock/TokenTimelockFactory.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/token-timelock/TokenTimelock.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/math/SafeCast.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/cryptography/ECDSA.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/token-timelock/interfaces/ITokenTimelock.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/extensions/GovernorVotes.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/token-factory/interfaces/IERC20Factory.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/ERC20Rewards2.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/interfaces/IStaking.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/proxy/transparent/ProxyAdmin.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/security/ReentrancyGuard.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/extensions/IVotes.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/math/BoringMath.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/token-timelock/interfaces/ITokenTimelockFactory.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/packages/RewardsCalculator.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/introspection/ERC165.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/ERC20Rewards2.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/SafeERC20.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/extensions/GovernorTimelockControl.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/packages/StakingPackage.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/interfaces/IStakingStorage.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/packages/RewardsCalculator.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/introspection/IERC165.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/interfaces/IStakingHandler.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/helpers/IStakingHelper.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/security/IAdminPausable.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/interfaces/IStakingHandler.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/extensions/GovernorCountingSimple.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/treasury/interfaces/IMultiSigWallet.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/Context.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/ERC20/IERC20.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/VMainToken.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/Ownable.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/math/Math.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/ERC20/extensions/ERC20Permit.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/extensions/GovernorVotesQuorumFraction.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/structs/DoubleEndedQueue.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/library/RewardsLibrary.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/cryptography/ECDSA.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/IBox.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/token-factory/ERC20Factory.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/vault/interfaces/IVault.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/math/BoringMath.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/Address.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/treasury/MultiSigWallet.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/ERC20/ERC20.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/treasury/MultiSigWallet.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/proxy/VaultProxyAdmin.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/interfaces/IRewardsHandler.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/library/StakingLibrary.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/interfaces/IRewardsHandler.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/MainToken.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/vault/interfaces/IVaultEvents.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/TimelockController.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/ERC20/IERC20.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/structs/Timers.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/security/Pausable.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/treasury/interfaces/IMultiSigWallet.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/ERC20Rewards1.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/security/AdminPausable.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/helpers/StakingGettersHelper.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/interfaces/IStakingEvents.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/extensions/GovernorCountingSimple.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/packages/StakingGetters.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/interfaces/IStakingStorage.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/interfaces/IGovernor.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/staking/upgrades/VaultUpgrade.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/extensions/GovernorSettings.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/Ownable.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/token-timelock/interfaces/ITokenTimelock.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/helpers/IStakingGetterHelper.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/Box.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/proxy/StakingProxyAdmin.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/token-timelock/TokenTimelock.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/security/Pausable.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/StakingStructs.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/StakingStorage.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/library/RewardsLibrary.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/interfaces/ITimelockController.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/ERC20Rewards1.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/packages/RewardsInternals.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/introspection/IERC165.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/structs/Counters.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/IVMainToken.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/vault/interfaces/IVaultEvents.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/introspection/ERC165.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/extensions/GovernorTimelockControl.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/token-timelock/TokenTimelockFactory.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/helpers/IStakingGetterHelper.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/packages/StakingGetters.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/GovernorStructs.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/proxy/transparent/TransparentUpgradeableProxy.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/ERC20/extensions/ERC20Permit.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/helpers/StakingGettersHelper.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/proxy/transparent/ProxyAdmin.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/StakingStructs.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/proxy/VaultProxy.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/ERC20/extensions/ERC20Votes.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/math/SafeCast.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/tokens/IVMainToken.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/math/FullMath.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/access/IAccessControl.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/structs/Timers.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/test/Box.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/packages/StakingPackage.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/governance/extensions/IGovernorTimelock.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/dao/staking/packages/StakingHandler.sol at commit daa757804b549f91904ec18af91259f7fe434883
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/security/ReentrancyGuard.sol at commit 5e9f3a23bd2b6deb9babe1a3ad984fd84cf51b7a
  • https://github.com/Into-the-Fathom/fathom-dao-smart-contracts/contracts/common/cryptography/EIP712.sol at commit daa757804b549f91904ec18af91259f7fe434883

Part of Fathom’s security record

Fathom
Audits2 audits by 1 firmLast audit Jan 2024, by OXORIO.
Critical findings3 criticals acknowledged, not fixedReported in “Fathom Stablecoin” by OXORIO, Jan 2024. The team acknowledged all 3.
Open Fathom’s security record

Security firm

OXORIO

6 projects reviewed · 15 reports · latest Dec 2024

See OXORIO’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us