AirLyft security record
As of 3 Nov 2026, AirLyft has 1 audit report on Trustblock, by QuillAudits, dated 18 Jul 2024. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| AirLyft | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Findings5
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 0 | 2 |
HighFee on transfer tokens unhandled properlyAirLyft · QuillAudits · 18 Jul 2024Fixed
This smart contract intends to be compatible with any ERC20 token, which includes the Fee-On-Transfer tokens .An example would be the USDT contract which has the functionality in its contract but is currently disabled. If enabled, it would break functionality of the contract since the recorded totalLiquidity is now less than the actual token balance of the contract.This can be exploited in a scenario where a user USER A creates a pool to airdrop a popular token to multiple users. A malicious user USER B could create another pool with the same token, then run multiple deposits and withdrawals which will reduce the token balance of the contract address while maintaining the pool’s totalLiquidity. USER B then calls withdraw() to pull their funds from the contract while the token balance is now less than the totalLiquidity of USER A pool.
Open the reportMediumETH Stuck in contractAirLyft · QuillAudits · 18 Jul 2024Fixed
In the deposit() function of the contract. It permits ERC20 deposits to ERC20 pools, however since it is a payable function, users can in error pass in eth to the deposit call as an msg.value .Also the contract consists of a receive()and fallback()which allows eth to be sent directly to the contract. Any eth sent to the contract will be permanently stuck in the contract.
Open the reportMediumSafeTransfer/SafeTransferFromAirLyft · QuillAudits · 18 Jul 2024Fixed
Not all tokens match the standard of returning false on failure, some tokens might not revert on failure, while some do not return any boolean. It is therefore advised to use the SafeERC20 library already imported from Open Zeppelin to handle transfers from the contract.
Open the reportLowuse call() instead of transfer() for EVM compatibilityAirLyft · QuillAudits · 18 Jul 2024Fixed
Usage of .transfer() instead of .call() to send ether during withdrawals has its potential downsides especially when using this across multiple EVM chains as mentioned by the Client. Some chains might not support the opcode, something similar would be the Zksync bug involving 921 ETH . Also there are potentials for break in smart contract functionality due to future upgrades in gas prices.
Open the reportLowuse of safemath libraryAirLyft · QuillAudits · 18 Jul 2024Fixed
At multiple points within the repo, SafeMath is used to handle addition .add() and subtraction .sub(), however it is important to note that the solidity version used here being : pragma solidity 0.8.17; already handles overflow and underflow checks, hence it holds no functionality within this contract.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="airlyft"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us