Derify protocol security record
As of 3 Nov 2026, Derify protocol has 3 audit reports by 1 security firm on Trustblock; the latest is by CertiK, dated 7 Dec 2023. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Derify Protocol v2 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Derify protocol Ⅱ | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Derify Protocol | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings47
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 11 | 1 |
| Medium | 2 | 3 | 4 |
| Low | 11 | 0 | 14 |
HighCentralization Related RisksDerify Protocol · CertiK · 9 Sep 2022Open
In the contract `CommunityVestingVault` the role `_owner` has authority over the functions mentioned below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - lock any function centralizing functions through `lockFunction()` - unlock timelock on centralizing functions through `unlockFunction()` - add tokens that will be granted through `lockToken()` - add grants through `addGrant()` - revoke grants through `revokeGrant()` In the contract `PrivateVestingVault` the role `_owner` has authority over the functions mentioned below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - lock any function centralizing functions through `lockFunction()` - unlock timelock on centralizing functions through `unlockFunction()` - add tokens that will be granted through `lockToken()` - add grants through `addGrant()` - revoke grants through `revokeGrant()` In the contract `TeamVestingVault` the role `_owner` has authority over the functions mentioned below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - lock any function centralizing functions through `lockFunction()` - unlock timelock on centralizing functions through `unlockFunction()` - add tokens that will be granted through `lockToken()` - add grants through `addGrant()` - revoke grants through `revokeGrant()`
Open the reportMediumFinancial ModelsDerify protocol Ⅱ · CertiK · 16 Sep 2022Open
There is no competition between investors and liquidity providers. All the funds, profits and losses are contained in the project pool. So the development team assumes the profit and loss are flat in the position part or they have sufficient liquidity or a robust operating strategy to maintain this pool in balance. Financial models of blockchain protocols need to be resilient to attacks. They need to pass simulations and verifications to guarantee the security of the overall protocol. The financial model of this protocol is not in the scope of this audit.
Open the reportMediumInitial Token DistributionDerify Protocol · CertiK · 9 Sep 2022Open
All of the derify protocol tokens are sent to five addresses when deploying the contract. This could be a centralization risk as the deployer can distribute these tokens without obtaining the consensus of the community.
Open the reportLowAddress Not Initialized but UsedDerify Protocol v2 · CertiK · 7 Dec 2023Open
In the above-mentioned contract, the address is used, however, this address is never set up which will lead to call failure as a result.
Open the reportLowFunction Calls User-Provided Addresses With No AcDerify Protocol v2 · CertiK · 7 Dec 2023Open
Calling a user provided address is dangerous, especially in a public function with no access control restriction. An attacker could deploy a malicious contract and use the vulnerable function to trigger a call to the malicious contract, potentially stealing user funds or causing other serious damages.
Open the reportLowLack of access controlDerify Protocol v2 · CertiK · 7 Dec 2023Open
The withdraw function can be call by anyone to drain the WETH of the contract and send to any address. However, the funds were stored in the main contract. If this contract is deployed by itself, this is an issue.
Open the reportLowLack of Input ValidationDerify Protocol v2 · CertiK · 7 Dec 2023Open
The below functions do not perform any checks to ensure that the amount parameter is greater than zero. If a user calls the functions with an amount of zero, it will add unnecessary data to the storage. - function `stakingDrf()` - function `depositBondToBank()`
Open the reportLowOut of Scope DependenciesDerify Protocol v2 · CertiK · 7 Dec 2023Open
The `template` is serving as the underlying entity to interact with out-of-scope smart contracts. And the project relies on the correctness of swapping tokens to cover the cost of the gas used by the executor. The scope of the audit treats those out-of-scope contracts, programs as black boxes and assumes their functional correctness. However, in the real world, they can be compromised and may lead to lost or stolen assets. ```solidity address template = IDerifyExchangeModule(exchangeModule).getMarginTokenPriceFeedTemplate(protocol, marginToken); (bool success, bytes memory d) = template.delegatecall( abi.encodeWithSignature( "swapGas(uint256,address,address,address,address)", _adjustMarginTokenAmount(gasFeeAmount), protocol, marginToken, tokenWBNB, _msgSender() ) ```
Open the reportLowPotential Divide by zeroDerify Protocol v2 · CertiK · 7 Dec 2023Open
--- ```solidity=80 uint256 amountVestedPerDay = amount / vestingDurationInDays; ``` The expression `amount / vestingDurationInDays` may divide by zero. Its divisor has has estimated interval [0, 9125]. --- ```solidity=299 uint256 amountVestedPerDay = grant.amount / uint256(grant.vestingDuration); ``` The expression `grant.amount / uint256(grant.vestingDuration)` may divide by zero. Its divisor has has estimated interval [0, 65535]. --- ```solidity=237 uint256 newAddedPeriodBlocks = amount / brokerValidUnitNumber; ``` The expression `amount / brokerValidUnitNumber` may divide by zero. Its divisor has has estimated interval [0, 115792089237316195423570985008687907853269984665640564039457584007913129639935]. --- ```solidity=17 margin = size * spotPrice / SPOT_PRICE_DECIMAL * CONTRACT_DECIMAL / leverage; ``` The expression `size * spotPrice / SPOT_PRICE_DECIMAL` may divide by zero. Its divisor has has estimated interval [0, 115792089237316195423570985008687907853269984665640564039457584007913129639935].
Open the reportLowRedundant code componentsDerify Protocol v2 · CertiK · 7 Dec 2023Open
The `index` parameter in the `deleteOrderedLimitPositions()` function is redundant. The salt in the `createDerivative()` function is redundant.
Open the reportShow 4 more
LowUser information is not cleared when the user isDerify Protocol v2 · CertiK · 7 Dec 2023Open
When the user positions reaches the liquidation threshold, the user positions is liquidated and the order information is cleared, but the user information is not, which is not consistent with the logic of line 378. ```solidity=377 // remove trader IDerifyExchange(exchange).removeTrader(liquidateTraders[j]); ```
Open the reportLowVariables That Could Be Declared as ImmutableDerify Protocol v2 · CertiK · 7 Dec 2023Open
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportLowOptimization of function `deleteOrderedLimitPositDerify protocol Ⅱ · CertiK · 16 Sep 2022Open
The function `deleteOrderedLimitPositions()` no longer use the index parameter to do the precise deletion (in the old version), but uses the three conditions price, timestamp, and leverage to do the match. It's a little confusing because in any case, an index is more accurate than these conditional matches. Since the prototype of conditional deletion has already been formed, we recommend that the client use conditional matching to do batch deletions.
Open the reportLowThird Party Dependencies on priceFeedDerify protocol Ⅱ · CertiK · 16 Sep 2022Open
The contract is serving as the underlying entity to interact with third party `priceFeed` protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="derify-protocol"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us