Cask security record
As of 3 Nov 2026, Cask has 1 audit report on Trustblock, by CertiK, dated 18 Dec 2022. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Cask Audit 2 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings17
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 9 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 4 | 0 | 4 |
HighCentralization Risks in CaskChainlinkTopup.solCask Audit 2 · CertiK · 18 Dec 2022Open
In the contract `CaskChainlinkTopup` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. 
Open the reportHighCentralization Risks in CaskChainlinkTopupManagerCask Audit 2 · CertiK · 18 Dec 2022Open
In the contract `CaskChainlinkTopupManager` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and allow/disallow registries, withdraw any token from contract, and set important parameters and addresses. 
Open the reportHighCentralization Risks in CaskDCA.solCask Audit 2 · CertiK · 18 Dec 2022Open
In the contract `CaskDCA` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority, and set the DCA manager, the assets Merkle root, the trusted forwarder, and the DCA restrictions. 
Open the reportHighCentralization Risks in CaskDCAManager.solCask Audit 2 · CertiK · 18 Dec 2022Open
In the contract `CaskDCAManager` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority, set/unset blacklistAssets, fee distributor, parameters, and recover ERC-20Funds. 
Open the reportHighCentralization Risks in CaskJobQueue.solCask Audit 2 · CertiK · 18 Dec 2022Open
In the contract `CaskJobQueue` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and change the max queue age, and bucket size, and arbitrarily set the queue position 
Open the reportHighCentralization Risks in CaskP2P.solCask Audit 2 · CertiK · 18 Dec 2022Open
In the contract `CaskP2P` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and update the contract state variables. 
Open the reportHighCentralization Risks in CaskP2PManager.solCask Audit 2 · CertiK · 18 Dec 2022Open
In the contract `CaskP2PManager` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and update contract state variables.  In the contract `CaskP2PManager` the role `_owner`, derived from `CaskJobQueue`, has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and update contract state variables. 
Open the reportHighCentralization Risks in Subscription Related ContCask Audit 2 · CertiK · 18 Dec 2022Open
In the contract `CaskSubscriptionManager` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and pause/unpause the contract and set important parameters.  ----- In the contract `CaskSubscriptionPlans` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and pause/unpause the contract and set important addresses such as trusted forwarder, manager, etc.  ----- In the contract `CaskSubscriptions` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and pause/unpause the contract and arbitrarily set trusted forwarder and manager. 
Open the reportHighCentralized Control of Contract UpgradeCask Audit 2 · CertiK · 18 Dec 2022Open
Casks are upgradeable contracts, the owner can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.
Open the reportLowDivide Before MultiplyCask Audit 2 · CertiK · 18 Dec 2022Open
Performing integer division before multiplication truncates the low bits, losing the precision of calculation. The function will be reverted if `(planData.period / 1 days)` is zero. ```solidity=165 uint256 loadFactor = 365 / (planData.period / 1 days); ``` ```solidity=166 uint256 noFeeTarget = subscriptions.getProviderSubscriptionCount(subscription.provider, false, 0) * stakeTargetFactor * loadFactor; ``` --- ```solidity=169 paymentFeeRateAdjusted = paymentFeeRateMax - (paymentFeeRateMax * (stakedBalance / noFeeTarget)); ```
Open the reportShow 3 more
LowMissing sanity checks on Fee settingCask Audit 2 · CertiK · 18 Dec 2022Open
The fees for the linked contracts can be updated, while the upper limit is either missing or set to 100%.
Open the reportLowThird Party DependencyCask Audit 2 · CertiK · 18 Dec 2022Open
The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=41 IERC20Metadata public linkBridgeToken; ``` - The contract `CaskChainlinkTopupManager` interacts with third party contract with `IERC20Metadata` interface via `linkBridgeToken`. --- ```solidity=42 LinkTokenInterface public linkFundingToken; ``` - The contract `CaskChainlinkTopupManager` interacts with third party contract with `LinkTokenInterface` interface via `linkFundingToken`. --- ```solidity=43 AggregatorV3Interface public linkPriceFeed; ``` - The contract `CaskChainlinkTopupManager` interacts with third party contract with `AggregatorV3Interface` interface via `linkPriceFeed`. --- ```solidity=45 IUniswapV2Router02 public linkSwapRouter; ``` - The contract `CaskChainlinkTopupManager` interacts with third party contract with `IUniswapV2Router02` interface via `linkSwapRouter`. --- ```solidity=46 IPegSwap public pegswap; ``` - The contract `CaskChainlinkTopupManager` interacts with third party contract with `IPegSwap` interface via `pegswap`. --- ```solidity=30 address _asset, ``` - The function `CaskTreasury.withdrawTo` interacts with third party contract with `IERC20` interface via `_asset`. --- ```solidity=48 address _contract ``` - The function `CaskTreasury.claim` interacts with third party contract with `IClaimable` interface via `_contract`. --- ```solidity=26 IERC20 public rewardToken; ``` - The contract `CaskVestedEscrow` interacts with third party contract with `IERC20` interface via `rewardToken`. --- ```solidity=421 address _asset, ``` - The function `CaskDCAManager.recoverFunds` interacts with third party contract with `IERC20Metadata` interface via `_asset`. --- ```solidity=134 address _asset, ``` - The function `CaskP2PManager.recoverFunds` interacts with third party contract with `IERC20Metadata` interface via `_asset`.
Open the reportLowUnknown Trusted Forwarder ImplementationCask Audit 2 · CertiK · 18 Dec 2022Open
The variable `_forwarder` serves as a 3rd party forwarder to help it identify the address of the Transaction Signer. The contract `CaskChainlinkTopup` override the `_msgSender()` function to get the `msg.sender` from `BaseRelayRecipient`. The scope of the audit treats these 3rd party forwarders as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts. Reference: [EIP-2771](https://eips.ethereum.org/EIPS/eip-2771)
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="cask"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us