Chronos security record
As of 21 Oct 2026, Chronos has 3 audit reports by 2 security firms on Trustblock; the latest is by PeckShield, dated 16 Aug 2023. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Chronos: MaGaugeV2Upgradeable && ChronosMarketplac | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Open · GitHub |
| Chronos Exchange Audit | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Chronos Audit 2 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings42
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 5 |
| Medium | 0 | 2 | 7 |
| Low | 13 | 0 | 13 |
CriticalRevisited Logic of ChronosMarketplace::placeBidWithETH()Chronos: MaGaugeV2Upgradeable && ChronosMarketplac · PeckShield · 16 Aug 2023Fixed
The report gives no description here.
Open the reportCriticalRevisited Logic of MaGaugeV2Upgradeable::split()Chronos: MaGaugeV2Upgradeable && ChronosMarketplac · PeckShield · 16 Aug 2023Fixed
The report gives no description here.
Open the reportHighLack of Input Validation in ChronosMarketplace::makeOfferWithETH()Chronos: MaGaugeV2Upgradeable && ChronosMarketplac · PeckShield · 16 Aug 2023Fixed
The report gives no description here.
Open the reportHighPossible Front-Running for ChronosMarketplace::buyNow()Chronos: MaGaugeV2Upgradeable && ChronosMarketplac · PeckShield · 16 Aug 2023Fixed
The report gives no description here.
Open the reportHighRevisited Precision in MaGaugeV2Upgradeable::rewardPerToken()Chronos: MaGaugeV2Upgradeable && ChronosMarketplac · PeckShield · 16 Aug 2023Fixed
The report gives no description here.
Open the reportHighState Variables in Upgradeable Contracts are InitChronos Audit 2 · CertiK · 21 Apr 2023Fixed
State variables initialized when declared are equivalent to initializing them inside the constructor. Therefore, initializing state variables when declared in an upgradeable contract has no actual effect since the constructor of an upgradeable contract is never called. ```solidity=82 uint PRECISSION = 1000; ```
Open the reportHighTransfer Tokens from Airdrop Contract Without AppChronos Audit 2 · CertiK · 21 Apr 2023Fixed
The `_deposit_for` function transfers tokens from the `AirdropClaimChrNFT` contract without approval. Therefore, if the airdrop boost feature is triggered when locking tokens into the `VotingEscrow`, calling the `IERC20(token).transferFrom` method will result in an error.
Open the reportMediumIncorrect Maximum Supply CheckChronos Exchange Audit · CertiK · 31 May 2023Fixed
```solidity=171 require(totalSupply()+ MAX_RESERVE + amount <= MAX_SUPPLY, "Mint would exceed max supply."); ``` The `totalSupply()` function returns the total amount of NFTs, including both minted reserved NFTs and minted sold NFTs. The `MAX_RESERVE` variable represents the maximum amount of reserved NFTs that can be minted. However, adding the result of `totalSupply()` to `MAX_RESERVE` would result in double-counting the minted reserved NFTs. As a result, the `mint()` function will revert before the maximum supply of NFTs is reached. Furthermore, the formula for token ID calculation has the same issue, the calculated token ID is larger than expected.
Open the reportMedium`supply` is not updatedChronos Audit 2 · CertiK · 21 Apr 2023Fixed
In the `_deposit_for()` function, when a user meets the bonus airdrop conditions, the user's locked amount increases, but the `supply` does not. However, in the `withdraw()` function, the `supply` decreases, which can cause subsequent withdrawals to fail because the locked amount may be greater than the `supply`.
Open the reportMediumFunction `transfer` of Contract `Chronos` May CauChronos Audit 2 · CertiK · 21 Apr 2023Fixed
Any invocation of `transfer(recipient, amount)` must fail if it causes the balance of the `recipient` address to overflow. This is not ensured by `Chronos.transfer`, i.e. it admits transfers that lead to an overflow of the recipient's balance and thereby to an irrecoverable loss of large amounts of tokens.
Open the reportShow 10 more
MediumFunction `transferFrom` of Contract `Chronos` MayChronos Audit 2 · CertiK · 21 Apr 2023Fixed
Any call of the form `transferFrom(from, dest, amount)` with a value in `amount` whose transfer would lead to an overflow of the balance of the `dest` address should fail. However, in Chronos, some invocations of `transferFrom(from, dest, amount)` cause an overflow in the recipient's balance.
Open the reportMediumNFT Buyer May Not Be Able to Claim WETHChronos Audit 2 · CertiK · 21 Apr 2023Fixed
The claimable rewards for ChrNFT minters are calculated using the following formula: ```solidity=117 _reward += _fee * weight / (_tot - _resAmnt); ``` The total rewards are divided by the sold ChrNFT number, which means the rewards are shared by NFT buyers but not by reserved NFT minters. Meanwhile, the `claim` function does not check whether the reward claimer is an NFT buyer. If the reserved NFT owner claims rewards before buyers, some NFT buyers will not be able to claim rewards.
Open the reportMediumNFT Buyers Claim Less Airdrop Tokens Than ExpecteChronos Audit 2 · CertiK · 21 Apr 2023Fixed
```solidity=118 uint timeElapsedSinceStart = block.timestamp - START_VESTING; uint claimable Percent = (timeElapsedSinceStart*PRECISION)/VESTING_PERIOD; userInfo.CHRClaimable = _totalCHR*claimablePercent/PRECISION - claimedCHR[_who]; ``` If the value of `timeElapsedSinceStart * PRECISION` is greater than `VESTING_PERIOD`, the calculated `claimablePercent` exceeds 100%. Consequently, if some NFT buyers do not claim all the airdrops, other NFT buyers can claim more airdrops than `_ogMints * _amountPerNFT`. After the vesting period has ended for some time, NFT buyers who have not claimed any airdrops can only claim a portion of the airdrops that originally belonged to them.
Open the reportMediumunreset `supply`Chronos Audit 2 · CertiK · 21 Apr 2023Fixed
The `merge()` function merges the value of `_from` NFT into the `_to` NFT and burns the `_from` NFT. However, the `supply` variable in the `_deposit_for()` function, which represents the total value of all NFTs deposited into the contract, is added again during the merge process. As a result, the `supply` value will be larger than before, since the value of `_from` is not deducted from the `supply` after the merge is complete.
Open the reportLowCheck Effect Interaction Pattern ViolatedChronos Audit 2 · CertiK · 21 Apr 2023Fixed
The order of external call and storage manipulation must follow the check-effect-interaction pattern. The tokens are transferred before the state is updated.
Open the reportLowLack of Storage Gap in Upgradeable ContractChronos Audit 2 · CertiK · 21 Apr 2023Fixed
There is no storage gap preserved in the logic contracts. Any logic contract that acts as a base contract that needs to be inherited by other upgradeable children should have a reasonable size of storage gap preserved for the new state variable introduced by the future upgrades.
Open the reportLowmismatch between the function definition and theChronos Audit 2 · CertiK · 21 Apr 2023Fixed
The `EIP712Domain()` function specifies parameters `name`, `chainId`, and `verifyingContract`. However, the parameter `version` is passed in when calling the "abi.encode()" function, causing a mismatch between the function definition and the passed parameter. ```solidity=1484 bytes32 public constant DOMAIN_TYPEHASH = keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)"); ``` ```solidity=1484 bytes32 domainSeparator = keccak256( abi.encode( DOMAIN_TYPEHASH, keccak256(bytes(name)), keccak256(bytes(version)), block.chainid, address(this) ) ); ```
Open the reportLowMissing check `attachments[_tokenId] > 0`Chronos Audit 2 · CertiK · 21 Apr 2023Fixed
The function lacks a sanity check to ensure that `attachments[_tokenId]` is greater than 0. This omission could cause the function to revert when `attachments[_tokenId]` is 0.
Open the reportLowNo Upper Limit in `setReferralFee` functionChronos Audit 2 · CertiK · 21 Apr 2023Fixed
There are no upper boundaries for `setReferralFee` which is used to set the referral fee. It is possible to set the total fee rate up to any arbitrary amount.
Open the reportLowRedundant StatementsChronos Audit 2 · CertiK · 21 Apr 2023Fixed
The linked statements do not affect the functionality of the codebase and appear to be either remnants of test code or older functionality.
Open the reportShow 7 more
LowRedundant Statements When Calculating Airdrop BooChronos Audit 2 · CertiK · 21 Apr 2023Fixed
The airdrop `_boostValue` to be added to the locked token amount is calculated by the formula `_boostValue = _value*minBonusPercent / PRECISSION`, where `_value` is the amount to be deposited and `minBonusPercent` is set by the `team` role. The calculations from lines 772 to 780 are irrelevant to `_boostValue` and are unnecessary. Furthermore, when `_bonusTime` is smaller than `maxBonusTime`, setting `_bonusPercent` to `maxBonusPercent` in line 775 is incorrect. In addition, `_bonusPercent` is written twice, but not used in between. ```solidity=776 _bonusPercent = maxBonusPercent; ``` ```solidity=780 _bonusPercent = _bonusTime*PRECISSION/maxBonusTime; ```
Open the reportLowRemove `token` from `tokenToRoutes` TwiceChronos Audit 2 · CertiK · 21 Apr 2023Fixed
On line 194, `token` has been removed from the `tokenToRoutes` map and is removed again on line 196.
Open the reportLowState Variable Should Be Declared ConstantChronos Audit 2 · CertiK · 21 Apr 2023Fixed
State variables that never change should be declared as `constant` to save gas. --- ```solidity=18 address public redemptionReceiver; ``` - `redemptionReceiver` should be declared `constant`. --- ```solidity=19 address public merkleClaim; ``` - `merkleClaim` should be declared `constant`. --- ```solidity=26 uint public DISTRIBUTION = 7 * 86400; ``` - `DISTRIBUTION` should be declared `constant`. --- ```solidity=82 uint PRECISSION = 1000; ``` - `PRECISSION` should be declared `constant`. --- ```solidity=16 bool public init; ``` - `init` should be declared `constant`. --- ```solidity=21 uint256 public tokenPerSec; ``` - `tokenPerSec` should be declared `constant`.
Open the reportLowThe airdrop reward will be changed based on the `Chronos Audit 2 · CertiK · 21 Apr 2023Fixed
The amount that users can claim from the airdrop depends on the value of the 'totalAirdrop'. When the 'owner' or 'depositors' add or remove tokens from the contract, the claimable amount will change. This means that users might be able to claim more than once if the 'totalAirdrop' increases after the user claims for the first time. For most projects that perform an airdrop, it usually will be a one-time thing, and the amount will be pre-determined. ```solidity=99 uint _totalSupply = IChrNFT(chrNFT).totalSupply(); uint _amountPerNFT = totalAirdrop/_totalSupply; uint _amount = _ogMints * _amountPerNFT; uint _veShare = (VE_SHARE * _amount) / PRECISION; userInfo.veCHRTotal = _veShare; userInfo.veCHRClaimed = claimedVeCHR[_who]; userInfo.veCHRLeft = _veShare - userInfo.veCHRClaimed; userInfo.veCHRClaimable = userInfo.veCHRLeft; ```
Open the reportLowUnnecessary `require` StatementChronos Audit 2 · CertiK · 21 Apr 2023Fixed
Comparisons that are always true or always false may be incorrect or unnecessary. The variable "_pid" is unsigned integer, which will always be larger than 0. ```solidity=109 require(_pid >= 0, "zero"); ```
Open the reportLowUnused State VariableChronos Audit 2 · CertiK · 21 Apr 2023Fixed
One or more state variables are never used in the codebase. Variable `DURATION` in `VoterV2_1` is never used in `VoterV2_1`. Variable `redemptionReceiver` in `Chronos` is never used in `Chronos`.
Open the reportLowUpdate the parameter `totalAirdrop` without checkChronos Audit 2 · CertiK · 21 Apr 2023Fixed
The `deposit()` function increases the `totalAirdrop` by the corresponding amount when the caller transfers tokens to the contract and decreases it when the caller withdraws tokens. However, there is an issue where the `totalAirdrop` is also decreased if the input parameter `_token` is not equal to `token`. If someone transfers another token to the contract and the caller withdraws it, it would lead to an incorrect amount calculation in the `claimable` function, and the `token` tokens cannot be withdrawn.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="chronos-exchange"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us