CIAN Protocol security record
As of 31 Oct 2026, CIAN Protocol has 4 audit reports by 2 security firms on Trustblock; the latest is by Ackee Blockchain Security, dated 16 Dec 2024. Those reports list no open critical findings. It also holds 48 deployed contracts on 3 chains.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Cian Yield Layer | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Cian Polygon Audit | Security firm: Paladin | Date: | Scope: 17 addresses on Polygon (POS) | No open critical findings | Open · paladinsec.co |
| Audit Report | Security firm: Paladin | Date: | Scope: 14 addresses on Avalanche | No open critical findings | Open · paladinsec.co |
| Audit Report | Security firm: Paladin | Date: | Scope: 17 addresses on Ethereum | No open critical findings | Open · paladinsec.co |
Findings156
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 7 |
| Medium | 4 | 4 | 23 |
| Low | 6 | 35 | 76 |
HighThe adapter does not return leftover balancesCian Polygon Audit · Paladin · 3 Jan 2023Fixed
The report gives no description here.
Open the reportHigh_multiCall does not validate that the _certifiedAddress is unset after the individual iterations are fulfilled allowing a malicious operator to drain and even destroy user proxiesAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportHighGovernance Issue: The implementation is a proxyAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportHighLack of authentication on flashLoan callAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportHighrecoverSigner allows anyone to fake signatures for the zero addressAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportHighSAVAX redemptions might eventually relock or run out of gasAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportHighSELFDESTRUCT can potentially be executed on an uninitialized implementationAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportMediumPool state variables have insufficient data validationCian Yield Layer · Ackee Blockchain Security · 16 Dec 2024Fixed
The report gives no description here.
Open the reportMediumThe adapter is not compatible with tokens that have a fee on transferCian Polygon Audit · Paladin · 3 Jan 2023Fixed
The report gives no description here.
Open the reportMediumThe adapter is not compatible with tokens that have a fee on transferCian Polygon Audit · Paladin · 3 Jan 2023Fixed
The report gives no description here.
Open the reportShow 10 more
MediumAny authorized address can become the only authorized addressAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportMediumApproval flow does not contain necessary safeguardsAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportMediumGovernance privilege: balanceController can take funds from users’ accountsAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportMediumGovernance privilege: The timelock could be used to steal users’ tokensAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportMediumGovernance privilege: The timelock could be used to steal users’ tokensAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportMediumonFlashLoan callback is vulnerable to reentrancyAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportMediumOperations do not revert if underlying protocols are pausedAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportMediumPhishing risk: Malicious admins can be usedAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportMediumrepay may use an outdated valueAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportMediumThe initiator address of the onFlashLoan is not reliableAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
MediumThe removeAuth function can be called multiple time with the same valuesAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportMediumUser can get sandwiched and suffer high slippageAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportMediumValidation on withdrawAssetsToAccount is almost completely uselessAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportMediumFees are incorrectly transferred back to the userAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportMediumreferral is only set within the logic contractAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportMediumThe exchangeDebt function could be delegatecalled directly by any contractAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportMediumThe multicall function might fail or send too much EtherAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportMediumThe positionTransfer function does not refund enough tokens at the end of the flashloanAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportMediumThe reentrancy check during flashloan is null and voidAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportMediumThe verifierBasic contract is potentially vulnerableAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowDouble-entrypoint initialize functionsCian Yield Layer · Ackee Blockchain Security · 16 Dec 2024Fixed
The report gives no description here.
Open the reportLowAaveRepay event might emit the wrong parameterCian Polygon Audit · Paladin · 3 Jan 2023Fixed
The report gives no description here.
Open the reportLowMatic can get stuck in the contract during a depositCian Polygon Audit · Paladin · 3 Jan 2023Fixed
The report gives no description here.
Open the reportLowmaxFlashLoan returns an incorrect valueCian Polygon Audit · Paladin · 3 Jan 2023Fixed
The report gives no description here.
Open the reportLowNo view function for pending requestsCian Polygon Audit · Paladin · 3 Jan 2023Fixed
The report gives no description here.
Open the reportLowThe reentrancy check is flawedCian Polygon Audit · Paladin · 3 Jan 2023Fixed
The report gives no description here.
Open the reportLowvault can be made constantCian Polygon Audit · Paladin · 3 Jan 2023Fixed
The report gives no description here.
Open the reportLow_paused and suspendPermissions are privateAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowadapManager, advancedOptionEnable and CertifiedAddress are privateAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowaddLiquidityAVAX contains a seemingly redundant transferAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
Lowapprovals, approve and revoke can be made externalAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowbalanceController and feeReceiver are privateAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowBankerJoeAdapter: Unused events — TraderJoeStake and TraderJoeUnstakeAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowBankerJoeAdapter: Unused variable — joeBarAddrAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowcallBytes of _callOnAdapter unnecessarily contains costETHAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowContract lacks an easy way for users to figure out the list of authorized addresses through explorer contract inspectionAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowdepositLpToken and withdrawLpToken can deposit into and withdraw from Masterchefs other than Trader JoeAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowDOMAIN_SEPARATOR can be made immutableAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowGas optimizationsAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowGas usage: getRegisteredAdapters might run out of gasAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowGetUserDepositPosition returns wrong valuesAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowGovernance privilege: The timelock can potentially sweep wallets through reentrancy during delegatecallsAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowJoeBar is now deprecatedAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowLack of events for initAuth, enable and disableAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowLack of events for initializeAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowLack of events for setCertified, setAdapManager, setAdvancedOption and other various common functionsAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowLack of events for setCodeHash and createAccountAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowLack of events for setPauseWhiteListAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowLack of events for setPublicVerifier, setAccountVerifier and setFlashLoanWhiteListAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowNon-transferrable timelock address might be limiting if the client ever wants to move to a new governance structureAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowonFlashLoan does not validate _multiCall parameter lengthsAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowpermit can be frontrun and cause denial of serviceAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowProxy receive() function prevents ControllerLib receive() from being calledAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowproxyAdmin can become outdatedAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowpullTokensIfNeeded might not pull in enough tokens for tokens with a fee on transferAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowrouter can be made constantAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowSafeMath is unnecessary starting from Solidity version 0.8Audit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowsetPauseWhiteList check can be simplifiedAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowThe adapter does not allow users to call emergencyWithdrawAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowThe initialize function does not call the initialize function safelyAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowThe JTokenSnapshot structure and IJToken import are unusedAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowThe OperatorUpdate event lacks the approval type variableAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowThe registerAdapters function allows the addition of too many adaptersAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowtrustFactory and timeLock are privateAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowTypographical and minor errorsAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowUI functions getUserProxyAdmin and getUserAccount can run out of gasAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowunregisterAdapters does not reset adaptersIndexAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowUnused event: CallForwardSignleAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowUnused event: ChangeAutomationAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowUnused import: IWAVAX.solAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowUnused import: Record and ProxyAdminAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowUnused importsAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowUnused imports, functionality and typographical errorsAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowUnused inheritance: OwnableUpgradeable.solAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowUnused Ownable inheritanceAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowuserDatabase and timelock are privateAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowuserProxyAdmin may be outdated and may have a shorter length to userAccountAudit Report · Paladin · 25 Oct 2022Fixed
The report gives no description here.
Open the reportLowaccountNum is a duplicate of the length functionAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportLowEther can get stuck in the contract during a depositAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportLowimplementationAddress must be made immutable for the value to be set correctly on the proxyAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportLowLack of events for all functionsAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportLowLack of validationAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportLowThe constructor does not emit the expected eventsAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportLowThe initialize function could be used to add malicious bad contractsAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportShow 6 more
LowTypographical errorAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportLowUnused importAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportLowUnused imports and variablesAudit Report · Paladin · 24 Sep 2022Fixed
The report gives no description here.
Open the reportContracts48
| Address | Chain | Source code |
|---|---|---|
| 0x0b20d5d59e14c71a948d55439019a2aaf74fa7b4 | Chain: Ethereum | Source code: Verified source |
| 0x5b465489ff729f73ec911245a84b25231b5824ba | Chain: Ethereum | Source code: Verified source |
| 0xc5c9953516635659e03345738d8390b7ada6351c | Chain: Ethereum | Source code: Verified source |
| 0xc936161b3c80494172ae58734e3ce16e26d493c1 | Chain: Ethereum | Source code: Verified source |
| 0xd896bf804c01c4c0fa5c42bf6a4b15c465009481 | Chain: Ethereum | Source code: Verified source |
| 0xb39e6f93cff9af7011810f41a4ed9b14582019b7 | Chain: Ethereum | Source code: Verified source |
| 0x53c8bf6875c66e8d7c42e30beef7e6241997f7e3 | Chain: Ethereum | Source code: Verified source |
| 0xa958090601e21a82e9873042652e35891d945a8c | Chain: Ethereum | Source code: Verified source |
| 0x68041721c81c695b72495f78beac4f7dfd7b19c8 | Chain: Ethereum | Source code: Verified source |
| 0xd3812219eb241053f9cf2b43f9b367c0b28e03da | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="cian"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us