COLONY security record

Avalanchecolonylab.ioXGitHub

As of 30 Oct 2026, COLONY has 2 audit reports by 1 security firm on Trustblock; the latest is by Paladin, dated 26 Feb 2024. Those reports list no open critical findings. It also holds 19 deployed contracts on 1 chain.

Critical findings
No open critical findings
Across 2 reports.
Open the latest report
Your label, live
Get the label for your site

Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.

Audits2

Newest first

AuditSecurity firmDateScopeCritical findingsReport
For Colony (Token & Staking)

Audit

Security firm: PaladinDate: Scope: 4 addresses on AvalancheNo open critical findingsOpen · paladinsec.co
Audit Report (Colony)

Audit

Security firm: PaladinDate: Scope: 15 addresses on AvalancheNo open critical findingsOpen · paladinsec.co

Findings111

Statuses are the security firm’s own, from each report.

SeverityOpenAcknowledgedFixed
Critical000
High0168
Medium079
Low21554
HighContract does not work with tokens that have a fee on transferFor Colony (Token & Staking) · Paladin · 26 Feb 2024Acknowledged

The report gives no description here.

Open the report
HighGovernance privilege: Freedom of configurations can result in allocation manipulationFor Colony (Token & Staking) · Paladin · 26 Feb 2024Acknowledged

The report gives no description here.

Open the report
HighGovernance privilege: Full control over staked fundsFor Colony (Token & Staking) · Paladin · 26 Feb 2024Acknowledged

The report gives no description here.

Open the report
HighPrivileged addresses can penalize/block full staking positionsFor Colony (Token & Staking) · Paladin · 26 Feb 2024Acknowledged

The report gives no description here.

Open the report
HighAdmin/Owner can steal the stablecoinAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
HighCodebase does not work with tokens that have a fee on transferAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
HighCompromised contract owner/admin can DoS functionalitiesAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
HighContract owner can DoS base functionalitiesAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
HighContract owner can steal all collected stablecoinsAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
HighGovernance: Privileged addresses can permanently lock users’ tokensAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
Show 10 more
HighGovernance: The contract owner can DoS deal finalizationAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
HighLack of validationAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
HighOwner of EarlyStageManager can harm the project via multiple vectorsAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
HighPrivileged addresses can permanently lock users’ tokensAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
HighSub-optimal implementation of swap logicAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
HighThe contract owner can DoS swapsAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
Mediummigration can be abused to bypass collateral checkFor Colony (Token & Staking) · Paladin · 26 Feb 2024Acknowledged

The report gives no description here.

Open the report
MediumRemoval of reward token will result in loss for usersFor Colony (Token & Staking) · Paladin · 26 Feb 2024Acknowledged

The report gives no description here.

Open the report
MediumChange of rewarder will lead to implicationsAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
MediumConsecutive project token claims will reset unlock progressAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
Show 10 more
MediumMalicious colonyAddress can block initial liquidity creationAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
MediumUsers can easily adjust their allocationsAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
MediumVesting data can only be updated after investments already happenedAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
LowCertain functions lack access controlFor Colony (Token & Staking) · Paladin · 26 Feb 2024Acknowledged

The report gives no description here.

Open the report
LowChange of AntToken can have undesired implicationsFor Colony (Token & Staking) · Paladin · 26 Feb 2024Acknowledged

The report gives no description here.

Open the report
LowcompoundStakeToken might not work with custom tokensFor Colony (Token & Staking) · Paladin · 26 Feb 2024Acknowledged

The report gives no description here.

Open the report
LowallocationToken can be made immutableAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
LowAn outdated version of OwnableUpgradeable is usedAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
LowEven with KYC-ed accounts, the contracts can still be Sybil attackedAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
LowGeneral architectural riskAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
Show 8 more
LowMalicious/invalid AntTierProgram contract can DoS swapsAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
LowMissing revert for failed deploymentsAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
LowRefunded phase cannot be initiated after finalInvestment is setAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
LowRemoval of KYC-ed status may result in forced penaltyAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
LowSet of invalid AntTierProgram can DoS swapsAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
LowtokenPrice lacks an upper limitAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
LowUpdate to the Portfolio phase can happen without LP/farm creationAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report
LowVariable swap fee approach does not work with account abstractionAudit Report (Colony) · Paladin · 19 Feb 2024Acknowledged

The report gives no description here.

Open the report

Contracts19

AddressChainSource code
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source

All 19 addresses

Show this on your site

Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.

Content

Facts

Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.

Fixed as
Language

Style

Layout
Theme
Accent
Corners

Format

Size
Date
Embed as
HTML
<head>
	<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
</head>
<body>
	<div
		data-tb-project-widget
		data-tb-project-slug="colony"
	></div>
</body>

Paste the code where the label should appear. It uses no API credit and updates by itself.

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us