CIAN Protocol security record
As of 31 Oct 2026, CIAN Protocol has 4 audit reports by 2 security firms on Trustblock; the latest is by Ackee Blockchain Security, dated 16 Dec 2024. Those reports list no open critical findings. It also holds 48 deployed contracts on 3 chains.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Cian Yield Layer | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Cian Polygon Audit | Security firm: Paladin | Date: | Scope: 17 addresses on Polygon (POS) | No open critical findings | Open · paladinsec.co |
| Audit Report | Security firm: Paladin | Date: | Scope: 14 addresses on Avalanche | No open critical findings | Open · paladinsec.co |
| Audit Report | Security firm: Paladin | Date: | Scope: 17 addresses on Ethereum | No open critical findings | Open · paladinsec.co |
Findings156
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 7 |
| Medium | 4 | 4 | 23 |
| Low | 6 | 35 | 76 |
MediumUsers have almost no control over their deposited fundsCian Yield Layer · Ackee Blockchain Security · 16 Dec 2024Acknowledged
The report gives no description here.
Open the reportMediumPrivilege escalation: The approvals functions allow the advancedTradingEnable boolean to be bypassedCian Polygon Audit · Paladin · 3 Jan 2023Acknowledged
The report gives no description here.
Open the reportMediumPrivilege escalation: The approve functions allow the bypassing of the advancedTradingEnable booleanAudit Report · Paladin · 24 Sep 2022Acknowledged
The report gives no description here.
Open the reportMediumThe positionTransfer function does not allow the transfer of stable rate borrowingsAudit Report · Paladin · 24 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowMissing initializers on constructorsCian Yield Layer · Ackee Blockchain Security · 16 Dec 2024Acknowledged
The report gives no description here.
Open the reportLowStrategy Position Limit Calculation InaccuracyCian Yield Layer · Ackee Blockchain Security · 16 Dec 2024Acknowledged
The report gives no description here.
Open the reportLowUsing transfer instead of callCian Yield Layer · Ackee Blockchain Security · 16 Dec 2024Acknowledged
The report gives no description here.
Open the reportLowAuthorized addresses are difficult to queryCian Polygon Audit · Paladin · 3 Jan 2023Acknowledged
The report gives no description here.
Open the reportLowLack of events for the initialize functionCian Polygon Audit · Paladin · 3 Jan 2023Acknowledged
The report gives no description here.
Open the reportLowpayable keyword not needed for stakeCian Polygon Audit · Paladin · 3 Jan 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowRewards can be distributed twice if the contract is paused too lateCian Polygon Audit · Paladin · 3 Jan 2023Acknowledged
The report gives no description here.
Open the reportLowrouter can be made constantCian Polygon Audit · Paladin · 3 Jan 2023Acknowledged
The report gives no description here.
Open the reportLowTypographical errorCian Polygon Audit · Paladin · 3 Jan 2023Acknowledged
The report gives no description here.
Open the reportLowTypographical errorsCian Polygon Audit · Paladin · 3 Jan 2023Acknowledged
The report gives no description here.
Open the reportLowUnused import: IAToken.solCian Polygon Audit · Paladin · 3 Jan 2023Acknowledged
The report gives no description here.
Open the reportLowUnused variableCian Polygon Audit · Paladin · 3 Jan 2023Acknowledged
The report gives no description here.
Open the reportLowWithdrawals can be blocked if a token is removed from the list of trusted tokensCian Polygon Audit · Paladin · 3 Jan 2023Acknowledged
The report gives no description here.
Open the reportLowAdapter load-in allows for loading in a 32 bytes value while an address is just 20 bytesAudit Report · Paladin · 25 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowADAPTER_NAME is unaccessible during delegate callsAudit Report · Paladin · 25 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowControllerLib contains unnecessary logic which makes it less generic than it could beAudit Report · Paladin · 25 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowFunds could become permanently lost if a CertifiedAddress or adapter ever contains the SELFDESTRUCT opcode as it would delete the proxyAudit Report · Paladin · 25 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowGovernance could delist a market making redemption of tokens complicatedAudit Report · Paladin · 25 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowmulticall functions lack non-zero checksAudit Report · Paladin · 25 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowPhishing: Users might have difficulties to distinguish malicious transactions if the frontend is ever compromisedAudit Report · Paladin · 25 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSAVAXAdapter lacks various functionsAudit Report · Paladin · 25 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowThe current implementation limit the number of adapter to 240Audit Report · Paladin · 25 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowTypographical and minor errorsAudit Report · Paladin · 25 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowTypographical errorAudit Report · Paladin · 25 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowTypographical errorAudit Report · Paladin · 25 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowAddressArrayLib is unusedAudit Report · Paladin · 24 Sep 2022Acknowledged
The report gives no description here.
Open the reportShow 9 more
LowAuthorized addresses are difficult to queryAudit Report · Paladin · 24 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowGas optimizationsAudit Report · Paladin · 24 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowLack of proper message during edge casesAudit Report · Paladin · 24 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowmaxFlashLoan returns a wrong valueAudit Report · Paladin · 24 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowpositionTransfer could run out of gasAudit Report · Paladin · 24 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowThe positionTransfer function can only be called using the multicall functionAudit Report · Paladin · 24 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowThe reentrancy check is flawedAudit Report · Paladin · 24 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 24 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowvault can be made constantAudit Report · Paladin · 24 Sep 2022Acknowledged
The report gives no description here.
Open the reportContracts48
| Address | Chain | Source code |
|---|---|---|
| 0x0b20d5d59e14c71a948d55439019a2aaf74fa7b4 | Chain: Ethereum | Source code: Verified source |
| 0x5b465489ff729f73ec911245a84b25231b5824ba | Chain: Ethereum | Source code: Verified source |
| 0xc5c9953516635659e03345738d8390b7ada6351c | Chain: Ethereum | Source code: Verified source |
| 0xc936161b3c80494172ae58734e3ce16e26d493c1 | Chain: Ethereum | Source code: Verified source |
| 0xd896bf804c01c4c0fa5c42bf6a4b15c465009481 | Chain: Ethereum | Source code: Verified source |
| 0xb39e6f93cff9af7011810f41a4ed9b14582019b7 | Chain: Ethereum | Source code: Verified source |
| 0x53c8bf6875c66e8d7c42e30beef7e6241997f7e3 | Chain: Ethereum | Source code: Verified source |
| 0xa958090601e21a82e9873042652e35891d945a8c | Chain: Ethereum | Source code: Verified source |
| 0x68041721c81c695b72495f78beac4f7dfd7b19c8 | Chain: Ethereum | Source code: Verified source |
| 0xd3812219eb241053f9cf2b43f9b367c0b28e03da | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="cian"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us