Camelot DEX security record
As of 3 Nov 2026, Camelot DEX has 2 audit reports by 1 security firm on Trustblock; the latest is by Paladin, dated 14 Nov 2022. Those reports list no open critical findings. It also holds 9 deployed contracts on 1 chain.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Audit Report - Nitro & Presale | Security firm: Paladin | Date: | Scope: 2 addresses on Arbitrum | No open critical findings | Open · paladinsec.co |
| Audit Report | Security firm: Paladin | Date: | Scope: 7 addresses on Arbitrum | No open critical findings | Open · paladinsec.co |
Findings89
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 6 |
| Medium | 0 | 0 | 9 |
| Low | 3 | 6 | 65 |
High_harvest is flawed in several ways if a user withdraws before harvesting is allowedAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportHighclaimMasterRewards function is fundamentally flawedAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportHighGovernance risk: Governance can drain the pairsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportHighmergePositions allows anyone to steal other users positions and harvestsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportHighMEV bots can drain one asset of the pairAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportHighRedeem finalization is fundamentally flawed, allowing for an exploiter to finalize a redeem multiple timesAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportMediumA malicious rewardsToken2 can be added after the pool is published, blocking rewards and forcing emergency withdrawalsAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportMediumonNFTHarvest might start reverting as it blindly attempts to forward the full amountsAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportMedium_k lacks overflow protectionAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportMediumAnyone can boost any other user’s NFT without any form of approval, allowing users to DoS the burning of NFTsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
MediumGrailTokenV2 distributes emissions retroactively if emissions are re-enabled after being set to zeroAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportMediumThe destroyPosition function de-allocates from msg.sender instead of whomever allocated the actual boost pointsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportMediumThe mergePositions function is flawed and may delete the entire positionsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportMediumThe owner fee can be used to block deposits and withdrawalsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportMediumVarious functions including NFT transfers and updatePool are missing reentrancy-guardsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowaddRewards remains callable at the endTime while these rewards may not be claimableAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportLowAny xGrail reapproval attempt will fail and permanently prevent claiming on the contractAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportLowContract does not support deposit fee tokensAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportLowContract is not well suited for a create2 deployment patternAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportLowContract might not be compatible with all USDC deploymentsAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowemergencyWithdraw can still revert in the edge case that the rewardDebt calculation overflowsAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportLowGas optimizationAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportLowisValidNFTPool will break if it is used on any pool other than msg.senderAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportLowLack of handling of ownership renunciationAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportLowLack of reentrancy guards on various functionsAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportLowLack of validationAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportLowTypographical errors and gas optimizationsAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportLowUsers will be unable to claim grail if their xGrail amount is zeroAudit Report - Nitro & Presale · Paladin · 14 Nov 2022Fixed
The report gives no description here.
Open the reportLow_allocate and _deallocate lack usage whitelistingAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
Low_checkOnNFTHarvest is flawed for harvestPositionToAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLow_destroyPosition will revert in some edge-casesAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLow_grailToken can be made immutableAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLow_pools is privateAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLow_requireOnlyOperatorOrOwnerOf and _requireOnlyApprovedOrOwnerOf are doing the sameAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLow[Frontend] Phishing vulnerability for convertTo()Audit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowAllocations during redemption are not captured in the usageAllocations variableAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowcreate2 not checked against a zero responseAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowcreate2 success is unchecked (also present in Uniswap)Audit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowExcess XGrailToken will get stuck in the contractAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowExternal calls after K check are undesiredAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowfactory can be made immutableAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowforceDeallocate() does not unboost the pool position and does not properly function if the YieldBooster somehow gets out-of- sync with the XGrailTokenAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowGas optimizationAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowGas optimizationsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowGas optimizationsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowgetGrailByVestingDuration() can revert due to division by zeroAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowgetPoolAddressByIndex and getActivePoolAddressByIndex are uncallable due to a faulty guard clauseAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowgetPoolInfo lacks a guard-clauseAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowGovernance risk: maxSupply can be changed to an infinitely large numberAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowharvestPositionTo exposes a frontend-phishing vulnerabilityAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowHarvests break if xGrailRewardsShare is ever set to zeroAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowInconsistency: _harvestPosition does not update the boost multiplier if isUnlocked is enabledAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowInconsistency: _safeRewardsTransfer avoids failure if contract has insufficient but such checks are not present for the xGrail amount that is harvestedAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowinitialize function lacks an additional safeguardAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowLack of events in the constructorAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowLack of safeTransfer usage within _safeRewardsTransferAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowLack of validationAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowLack of validationAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowmassUpdatePool only updates the active pools, causing potentially significant rewards to be distributed in hindsight if a pool is ever reactivatedAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowmergePositions is overprotective with the lock duration guardsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowNewly added pools can dilute rewards retroactivelyAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowpermit can be frontrun to prevent someone from calling removeLiquidityWithPermit (also present in Uniswap)Audit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowreceive() lacks a safeguardAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowrenewLockPosition and lockPosition do not work if the lock is expiredAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowSome private variables should be made publicAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowsplitPosition does not burn the position if its completely emptiedAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowstartTime is not aligned with startTime from GrailTokenAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowThe createPosition function may create position with 0 amount when using tokens with a fee on transferAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowThe quote function returns erroneous values for the stableswapAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowThe transfer functions may have undesired side-effects with boosted tokensAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowTypographical errors and gas optimizationsAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowUnused definitionAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportLowVarious functions are not guarded against reentrancyAudit Report · Paladin · 30 Oct 2022Fixed
The report gives no description here.
Open the reportContracts9
| Address | Chain | Source code |
|---|---|---|
| 0xe0a6b372ac6af4b37c7f3a989fe5d5b194c24569 | Chain: Arbitrum | Source code: Verified source |
| 0x66ec1ee6c3ad04d7629ce4a6d5d19ba99c365d29 | Chain: Arbitrum | Source code: Verified source |
| 0x3d9907f9a368ad0a51be60f7da3b97cf940982d8 | Chain: Arbitrum | Source code: Verified source |
| 0x3caae25ee616f2c8e13c74da0813402eae3f496b | Chain: Arbitrum | Source code: Verified source |
| 0x6db1ef0df42e30acf139a70c1ed0b7e6c51dbf6d | Chain: Arbitrum | Source code: Verified source |
| 0xc873fecbd354f5a56e00e710b90ef4201db2448d | Chain: Arbitrum | Source code: Verified source |
| 0x6eccab422d763ac031210895c81787e87b43a652 | Chain: Arbitrum | Source code: Verified source |
| 0xd27c373950e7466c53e5cd6ee3f70b240dc0b1b1 | Chain: Arbitrum | Source code: Verified source |
| 0x55401a4f396b3655f66bf6948a1a4dc61dfc21f4 | Chain: Arbitrum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="camelot"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us