Arcadia security record

Base, Ethereum, Optimismarcadia.finance

As of 14 Oct 2026, Arcadia has 1 audit report on Trustblock, by Nethermind Security, dated 2 Mar 2023. That report lists no open critical findings.

Critical findings
No open critical findings
In that report, 3 critical findings were reported. Each is marked fixed by the firm that reported it. See the findings
Open the latest report
Your label, live
Get the label for your site

Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.

Audits1

Newest first

AuditSecurity firmDateScopeCritical findingsReport
Arcadia security reviewSecurity firm: Nethermind SecurityDate: Scope: Not recorded. See the report3 critical findings, fixedOpen · GitHub

Findings28

Statuses are the security firm’s own, from each report.

SeverityOpenAcknowledgedFixed
Critical003
High001
Medium004
Low2216
CriticalUnused collateral can be stolen from vaults through the lending poolArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
CriticalVault’s baseCurrency may differ from the one set by the TrustedCreditorArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
CriticalVaults can borrow from a lending pool different from their trusted creditorArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
HighPrivileged vault roles not reset upon ownership changeArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
MediumIncorrect calculation of openDebt during Vault liquidationArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
MediumminPriceMultiplier is not scaled to 20 decimals in _calcPriceOfVault(...)Arcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
MediumPricing module exposure can be manipulated for WETH tokenArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
MediumVault deployment susceptible to Denial of Service AttacksArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
LowAsset can be added with an inactive oracle or with no oraclesArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
LowAsset can be added with an incorrect oracle sequenceArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
Show 10 more
LowassetIds length may differ from amountsArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
LowClosing margin account doesn’t reset liquidatorArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
LowERC721 pricing modules exposure manipulationArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
LowFunction changeGuardian(...) does not emit the oldGuardianArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
LowFunctions will default to USD if an invalid baseCurrency is usedArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
LowHandling of ERC721 Assets May Be Incorrect in Action HandlerArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
LowLiquidator contract owner can manipulate live auction pricingArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
LowPossible optimization in getListOfValuesPerAsset(...)Arcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
LowRounding issues in DebtToken shares calculation can steal funds from LendingPoolArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
LowSome common ERC20 tokens can’t be depositedArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
Show 4 more
LowStorage load optimizationsArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
LowUnnecessary function onERC721Received(...) in factory contractArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
LowVault asset limit can be bypassed with vaultManagementAction(...)Arcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report
LowVault beneficiaries indirectly obtain the asset manager roleArcadia security review · Nethermind Security · 2 Mar 2023Fixed

The report gives no description here.

Open the report

Contracts

No deployed address is recorded for these audits.

The reports name a repository or files. Open a report to see its scope.

Show this on your site

Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.

Content

Facts

Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.

Fixed as
Language

Style

Layout
Theme
Accent
Corners

Format

Size
Date
Embed as
HTML
<head>
<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
</head>
<body>
<div
data-tb-project-widget
data-tb-project-slug="arcadia"
></div>
</body>

Paste the code where the label should appear. It uses no API credit and updates by itself.

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us