Covenant security record

Polygon (POS)covenant.vote

As of 10 Nov 2026, Covenant has 2 audit reports by 2 security firms on Trustblock; the latest is by Pashov Audit Group, dated 31 Aug 2025. Those reports list no open critical findings. It also holds 2 deployed contracts on 1 chain.

Critical findings
No open critical findings
Across 2 reports.
Open the latest report
Your label, live
Get the label for your site

Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.

Audits2

Newest first

ReportSecurity firmDateScopeCritical findingsSource
Covenant security reviewSecurity firm: Pashov Audit GroupDate: Scope: Not recorded; see the reportNone openGitHub ↗
Audit ReportSecurity firm: PaladinDate: Scope: 2 addresses on Polygon (POS)None openpaladinsec.co ↗

Findings43

Statuses are the security firm’s own, from each report.

SeverityOpenAcknowledgedFixed
Critical000
High002
Medium007
Low0628
HighNot excluding accruedProtocolFee from state update operations causes several issuesCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
HighThe MerkleDistributor unnecessarily allows for separate rewards to be stolen from each other if a single merkle tree allows to withdraw more rewards than were provided to that tree which allows forAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report
MediumEarly market can be DoSed by over-minting debtCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
MediumETWAP logic allows grief attacks on redeem flowCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
MediumMarket DoS when baseTokenSupply is 0 while Synth token supply is non-zeroCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
MediumRedeem cap bypassed using swap()Covenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
MediumSynthToken returns incorrect name, symbol, and decimalsCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
MediumGas grief risk: The priceDisputed callback might not be guaranteed to execute which could permanently lock-in fundsAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report
MediumUsers can call createReward with any whitelisted price identifierAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report
LowApproximate swap fee used for exact_out instead of exact calculationCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
Show 10 more
LowETWAP check blocks the last user from immediate full withdrawalCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
LowInconsistent LTV blocks zToken redemptions during undercollateralizationCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
LowInconsistent price reset behavior in full redemption scenariosCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
LowInconsistent redeem cap allows excessive withdrawalsCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
LowIncorrect 512-bit number comparison in computeLiquidity functionCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
LowIncorrect concat usage corrupts token name and symbolCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
LowLoss of protocol fee due to lack of decimal consideration during accrualCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
LowMarket state broken: mint() disabled but swaps creating debt allowedCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
LowMissing zero amount validation for non-base asset outputs in swapsCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
LowPotential division-by-zero in _dexToSynthCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
Show 10 more
LowPreview functions fail to verify the outputsCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
LowProtocol can be DOS due to arithmetic underflow in interest accrualCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
LowProtocol fee updates cause loss of accrued feesCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
Lowredeem caps inputs for calculation but burns uncapped amounts, causing revertsCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
Lowswap operation can lead to an undercollateralized stateCovenant security review · Pashov Audit Group · 31 Aug 2025Fixed

The report gives no description here.

Open the report
LowAn unprivileged syncUmaEcosystemParams function might be undesirableAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report
LowbondToken can be made immutableAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report
LowChecks-effects-interactions is not adhered to within various functionsAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report
LowGas optimizationsAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report
LowGovernance risk: Governance can pre-configure windows with malicious Merkle trees before transferring ownershipAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report
Show 7 more
LowipfsHash and customAncillaryData are privateAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report
LowipfsHash is privateAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report
LowLack of validationAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report
LowTypographical errorsAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report
LowTypographical errorsAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report
LowUnnecessary import: SafeMath.solAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report
LowUnused import: StoreInterface.solAudit Report · Paladin · 23 Jun 2022Fixed

The report gives no description here.

Open the report

Contracts2

AddressChainSource code
Chain: Polygon (POS)Source code: Verified source
Chain: Polygon (POS)Source code: Verified source

Show this on your site

Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.

Content

Facts

Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.

Fixed as
Language

Style

Layout
Theme
Accent
Corners

Format

Size
Date
Embed as
HTML
<head>
	<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
</head>
<body>
	<div
		data-tb-project-widget
		data-tb-project-slug="covenant"
	></div>
</body>

Paste the code where the label should appear. It uses no API credit and updates by itself.

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us