Time-Based Contracts (Venus)

Quantstamp18 Mar 2024Repository at commit 1a6cf0c

Part of Quantstamp’s series

Quantstamp reviewed Venus Protocol (Time-Based Contracts (Venus)) on 18 Mar 2024: 5 findings, 0 critical; 3 marked fixed, 2 acknowledged.

No open critical findings

Open the report Open Venus Protocol’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	0
Medium	0	0
Low	2	3

LowMismatch Between Function Name and String for Access ControlFixed

In the `setLastRewardingBlocks()` function of the `RewardsDistributor` contract, the input string to `_checkAccessAllowed()` is `setLastRewardingBlock` instead of `setLastRewardingBlocks` as the function name.

LowMissing Check for the Configured Mode of Reward Distributors in `PoolLens`Fixed

In the `_calculateNotDistributedAwards()` function of the `PoolLens` contract, the rewards are calculated based on the mode (time-based or block-based) that the reward distributor is configured. Since all the reward distributor contracts deployed on the same chain should use the same mode as `PoolLens`, consider adding a check to ensure they are in the same mode to reduce the risk of misconfiguration during contract deployment. Also, the local variable, `isTimeBased`, shadows a state variable inherited from the `TimeManagerV8`. It is generally recommended to avoid shadow variables as a best practice.

LowMissing Input ValidationFixed

It is important to validate inputs, even if they only come from trusted addresses, to avoid human error. The following is a non-exhaustive list of missing input validations: 1. In the `SetterFacet` contract, the `_setXVSVToken()` function sets the VToken contract corresponding to the XVS token. As a best practice, there can be a check on the provided argument `xvsVToken_` to ensure that the underlying token of `xvsVToken_` matches the configured `xvs`. 2. The constructor of the VToken contract should validate that the value of `MAX_BORROW_RATE_MANTISSA` is not greater than `1e18`. 3. In the `constructor()` of the `SequencerChainlinkOracle` contract, check that sequencer is not set to the zero address.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (22)

https://github.com/VenusProtocol/isolated-pools/contracts/Shortfall/Shortfall.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
https://github.com/VenusProtocol/oracle/contracts/oracles/ChainlinkOracle.sol at commit d8af5952e53bb5f1131b40d83bce0da3126dd0a7
https://github.com/VenusProtocol/isolated-pools/contracts/VTokenInterfaces.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
https://github.com/VenusProtocol/isolated-pools/contracts/VToken.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
https://github.com/VenusProtocol/isolated-pools/contracts/Lens/PoolLens.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
https://github.com/VenusProtocol/venus-protocol/contracts/Comptroller/ComptrollerStorage.sol at commit 96574ea27041ce9b3935ec03f7b8fce540475ec4
https://github.com/VenusProtocol/venus-protocol/contracts/XVSVault/XVSVaultStorage.sol at commit 4d7debdc67141b754217e5286476404eefc5549a
https://github.com/VenusProtocol/isolated-pools/contracts/Rewards/RewardsDistributorStorage.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
https://github.com/VenusProtocol/venus-protocol/contracts/Comptroller/Diamond/facets/RewardFacet.sol at commit 96574ea27041ce9b3935ec03f7b8fce540475ec4
https://github.com/VenusProtocol/isolated-pools/contracts/Rewards/RewardsDistributor.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
https://github.com/VenusProtocol/isolated-pools/contracts/Shortfall/ShortfallStorage.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
https://github.com/VenusProtocol/venus-protocol/contracts/Comptroller/Diamond/Diamond.sol at commit 96574ea27041ce9b3935ec03f7b8fce540475ec4
https://github.com/VenusProtocol/venus-protocol/contracts/XVSVault/XVSVault.sol at commit 4d7debdc67141b754217e5286476404eefc5549a
https://github.com/VenusProtocol/isolated-pools/contracts/WhitePaperInterestRateModel.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
https://github.com/VenusProtocol/isolated-pools/contracts/lib/constants.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
https://github.com/VenusProtocol/oracle/contracts/oracles/SequencerChainlinkOracle.sol at commit d8af5952e53bb5f1131b40d83bce0da3126dd0a7
https://github.com/VenusProtocol/isolated-pools/contracts/JumpRateModelV2.sol at commit 1a6cf0c1aea867cef4657670fb989dbc0b47c91c
https://github.com/VenusProtocol/venus-protocol/contracts/Tokens/VTokens/VToken.sol at commit 9cfeba718e68aa7294c9895c51037f9e9b81e450
https://github.com/VenusProtocol/venus-protocol/contracts/Comptroller/Diamond/facets/FacetBase.sol at commit 96574ea27041ce9b3935ec03f7b8fce540475ec4
https://github.com/VenusProtocol/venus-protocol/contracts/Comptroller/Diamond/facets/SetterFacet.sol at commit 96574ea27041ce9b3935ec03f7b8fce540475ec4
https://github.com/VenusProtocol/venus-protocol/contracts/Comptroller/Diamond/facets/RewardFacet.sol at commit 2d31b70eb263fb16e31b67e413ad581c683a8bf8
https://github.com/VenusProtocol/venus-protocol/contracts/XVSVault/TimeManagerV5.sol at commit 4d7debdc67141b754217e5286476404eefc5549a

Part of Venus Protocol’s security record

Venus Protocol

Audits67 audits by 7 firmsLast audit Sep 2025, by Quantstamp.

Critical findingsNo open critical findingsAcross the 67 reports, 4 critical findings were reported. Each is marked fixed by the firm that reported it.

IncidentIncident 12 May 2022Source: De.Fi incident database.

Open Venus Protocol’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us