Loot security record
As of 3 Nov 2026, Loot has 1 audit report on Trustblock, by CertiK, dated 28 Oct 2022. That report lists 1 critical acknowledged and not fixed.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Adventure Gold | Loot Staking | Security firm: CertiK | Date: | Scope: Files named in the report | 1 critical acknowledged, not fixed | Open · skynet.certik.com |
Findings11
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 1 |
| High | 3 | 0 | 0 |
| Medium | 0 | 1 | 0 |
| Low | 0 | 5 | 0 |
CriticalLogic Issue For Function `claim()`Adventure Gold | Loot Staking · CertiK · 28 Oct 2022Acknowledged
The function `claim` does not have any constraints to be invoked to mint the nft, so these nft can be minted to an address by anyone.
Open the reportMediumPotential Flashloan AttackAdventure Gold | Loot Staking · CertiK · 28 Oct 2022Acknowledged
Flash loans are a way to borrow large amounts of money for a certain fee. The requirement is that the loans need to be returned within the same transaction in a block. If not, the transaction will be reverted. If someone borrows `loot` from other protocols, he can gain `AGLD` token for free.
Open the reportLowFake RandomnessAdventure Gold | Loot Staking · CertiK · 28 Oct 2022Acknowledged
According to the logic, the function `random` needs to return a random number, however, if the input value is deterministic, then the return value is deterministic.
Open the reportLowHardcode AddressAdventure Gold | Loot Staking · CertiK · 28 Oct 2022Acknowledged
There is a hardcode addresses in this codebase.
Open the reportLowLack of Zero Address ValidationAdventure Gold | Loot Staking · CertiK · 28 Oct 2022Acknowledged
The given input is missing the check for the non-zero address.
Open the reportLowMissing Emit EventsAdventure Gold | Loot Staking · CertiK · 28 Oct 2022Acknowledged
Functions that affect the status of sensitive variables should be able to emit events as notifications to customers.
Open the reportLowPotential Incorrect ChecksAdventure Gold | Loot Staking · CertiK · 28 Oct 2022Acknowledged
If there are already a number of tokens in the contract, the passed-in `_amount` can be larger than the number of tokens transferred to the contract.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="adventure-gold"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us