Time-Based Contracts (Venus)

QuantstampRepository at commit 1a6cf0c

Audit

Part of Quantstamp’s series

Quantstamp reviewed Venus Protocol (Time-Based Contracts (Venus)) on 18 Mar 2024: 5 findings, 0 critical; 3 marked fixed, 2 acknowledged.

No open critical findings
Open the reportOpen Venus Protocol’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low023
LowCentralization RiskAcknowledged

The new function added to the `RewardFacet` in the core protocol called `seizeVenus()` allows the owner of the protocol to seize tokens from a given number of holders and transfer them to a provided recipient. A compromised owner could drain the protocol.

LowMisleading Function NameAcknowledged

The function `rewardTokenAmountsPerBlock(address _rewardToken)` returns the value stored in the `rewardTokenAmountsPerBlockOrSecond` mapping at the given `_rewardToken`. If the value stored in the mapping is in seconds, a misleading value would be returned.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (22)

  • https://github.com/VenusProtocol/isolated-pools/contracts/Shortfall/Shortfall.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
  • https://github.com/VenusProtocol/oracle/contracts/oracles/ChainlinkOracle.sol at commit d8af5952e53bb5f1131b40d83bce0da3126dd0a7
  • https://github.com/VenusProtocol/isolated-pools/contracts/VTokenInterfaces.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
  • https://github.com/VenusProtocol/isolated-pools/contracts/VToken.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
  • https://github.com/VenusProtocol/isolated-pools/contracts/Lens/PoolLens.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
  • https://github.com/VenusProtocol/venus-protocol/contracts/Comptroller/ComptrollerStorage.sol at commit 96574ea27041ce9b3935ec03f7b8fce540475ec4
  • https://github.com/VenusProtocol/venus-protocol/contracts/XVSVault/XVSVaultStorage.sol at commit 4d7debdc67141b754217e5286476404eefc5549a
  • https://github.com/VenusProtocol/isolated-pools/contracts/Rewards/RewardsDistributorStorage.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
  • https://github.com/VenusProtocol/venus-protocol/contracts/Comptroller/Diamond/facets/RewardFacet.sol at commit 96574ea27041ce9b3935ec03f7b8fce540475ec4
  • https://github.com/VenusProtocol/isolated-pools/contracts/Rewards/RewardsDistributor.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
  • https://github.com/VenusProtocol/isolated-pools/contracts/Shortfall/ShortfallStorage.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
  • https://github.com/VenusProtocol/venus-protocol/contracts/Comptroller/Diamond/Diamond.sol at commit 96574ea27041ce9b3935ec03f7b8fce540475ec4
  • https://github.com/VenusProtocol/venus-protocol/contracts/XVSVault/XVSVault.sol at commit 4d7debdc67141b754217e5286476404eefc5549a
  • https://github.com/VenusProtocol/isolated-pools/contracts/WhitePaperInterestRateModel.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
  • https://github.com/VenusProtocol/isolated-pools/contracts/lib/constants.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
  • https://github.com/VenusProtocol/oracle/contracts/oracles/SequencerChainlinkOracle.sol at commit d8af5952e53bb5f1131b40d83bce0da3126dd0a7
  • https://github.com/VenusProtocol/isolated-pools/contracts/JumpRateModelV2.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
  • https://github.com/VenusProtocol/venus-protocol/contracts/Tokens/VTokens/VToken.sol at commit 9cfeba718e68aa7294c9895c51037f9e9b81e450
  • https://github.com/VenusProtocol/venus-protocol/contracts/Comptroller/Diamond/facets/FacetBase.sol at commit 96574ea27041ce9b3935ec03f7b8fce540475ec4
  • https://github.com/VenusProtocol/venus-protocol/contracts/Comptroller/Diamond/facets/SetterFacet.sol at commit 96574ea27041ce9b3935ec03f7b8fce540475ec4
  • https://github.com/VenusProtocol/venus-protocol/contracts/Comptroller/Diamond/facets/RewardFacet.sol at commit 2d31b70eb263fb16e31b67e413ad581c683a8bf8
  • https://github.com/VenusProtocol/venus-protocol/contracts/XVSVault/TimeManagerV5.sol at commit 4d7debdc67141b754217e5286476404eefc5549a

Part of Venus Protocol’s security record

Venus Protocol
Audits67 audits by 7 firmsLast audit Sep 2025, by Quantstamp.
Critical findingsNo open critical findingsAcross the 67 reports, 4 critical findings were reported. Each is marked fixed by the firm that reported it.
IncidentIncident 12 May 2022Source: De.Fi incident database.
Open Venus Protocol’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us