DAOFi security record
As of 3 Nov 2026, DAOFi has 1 audit report on Trustblock, by Quantstamp, dated 8 Feb 2021. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| DAOFi | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings15
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 4 |
| Medium | 0 | 2 | 0 |
| Low | 0 | 7 | 2 |
MediumDenial-of-Service (DoS)DAOFi · Quantstamp · 8 Feb 2021Acknowledged
A Denial-of-Service (DoS) attack is a situation which an attacker renders some functionality unavailable. Specifically the function `createPair()` is prone to a DoS attack through front-running. A malicious user may front-run the function and provide a different `pairOwner` argument. Consequently, a new pair contract would have an owner chosen by the attacker. The same issue applies to functions `addLiquidity()` and `addLiquidityETH()`.
Open the reportMediumIncorrect input validationDAOFi · Quantstamp · 8 Feb 2021Acknowledged
When initializing `DAOfiV1Pair` using the function `initialize()`, following the natspec documentation, `_n` value should be between 1 and 3. However, the hardcoded `MAX_N` value is equal to 1 instead of 3 as documented.
Open the reportLowAdd and remove liquidity designDAOFi · Quantstamp · 8 Feb 2021Acknowledged
The functions `deposit()` and `withdraw()` can be called only once by the router contract, meaning that users won't be able to provide liquidity after the initial deposit call. Such implementation will cause higher slippage since there will be less liquidity in the pools (only one user is allowed to deposit, and only the owner is allowed to withdraw).
Open the reportLowAnyone Can Provide LiquidityDAOFi · Quantstamp · 8 Feb 2021Acknowledged
Since the pool is designed to allow only one liquidity provider, only the owner should be able to add and remove liquidity via `addLiquidity()` and `removeLiquidity()`. If another user uses a deployed pair and provides liquidity (through `addLiquidity()` or `addLiquidityETH()`), they will not be able to withdraw their deposit since only the owner is allowed to do so. Furthermore, a malicious user can deposit a small amount of tokens to deny service for the pool owner.
Open the reportLowCode hash computationDAOFi · Quantstamp · 8 Feb 2021Acknowledged
The L25 contains hardcoded code hash.
Open the reportLowGas Usage / `for` Loop ConcernsDAOFi · Quantstamp · 8 Feb 2021Acknowledged
Gas usage is a main concern for smart contract developers and users, since high gas costs may prevent users from wanting to use the smart contract. Even worse, some gas usage issues may prevent the contract from providing services entirely. Specifically, unvetted tokens may consume all the passed gas in L84.
Open the reportLowNumerical precisionDAOFi · Quantstamp · 8 Feb 2021Acknowledged
The function `_convert()` converts token amounts so that they have 8 decimals. This may result in lost precision.
Open the reportLowPrivileged Roles and OwnershipDAOFi · Quantstamp · 8 Feb 2021Acknowledged
Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract.
Open the reportLowRebasing tokensDAOFi · Quantstamp · 8 Feb 2021Acknowledged
DAOfi pair contract computations are incompatible with rebasing tokens.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="daofi"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us