Equito Finance security record
As of 3 Nov 2026, Equito Finance has 2 audit reports by 1 security firm on Trustblock; the latest is by CertiK, dated 28 Nov 2022. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Equito Finance | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · skynet.certik.com |
| Equito Finance Solidity | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings9
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 2 | 0 | 1 |
| Low | 1 | 0 | 4 |
HighFunction `transferFrom` of Contract `ERC20Usdc` UEquito Finance Solidity · CertiK · 28 Nov 2022Fixed
It is expected that non-reverting invocations of `transferFrom(from, dest, amount)` that return `true` decrease the allowance of the address in `msg.sender` for the address in `from` by the value in `amount`. An allowance that equals `type(uint256).max` is treated as an exception and interpreted as an unlimited allowance that does not need to be reduced in order for this check to pass. The `transferFrom` function in contract `ERC20Usdc` violates this property and, at least in some cases, fails to correctly update the allowance mapping according to the value in `amount`.
Open the reportMediumVote from removed validator still being validEquito Finance Solidity · CertiK · 28 Nov 2022Fixed
`validateRemoveValidator` is used for removing validators from the mapping `_validators`. After a validator is removed, his voting is still valid, as `_actions[actionId].validatorCnt` is not updated. Furthermore, it might cause a valid action being deleted. This would happen if `_actions[actionId].readCnt == _validators.length() + 2` before removing the validator.
Open the reportLow`on_burn` sends burned token to contract addressEquito Finance · CertiK · 28 Nov 2022Fixed
We noticed that tokens being burned are sent to the contract address, which is also the reserve address. Note that the burn operation is reversible in this case. The total supply is not changed in this case. Reference: https://forum.algorand.org/t/stablecoin-how-to-burn-the-asset-and-update-the-supply/1838
Open the reportLowUnused FunctionsEquito Finance · CertiK · 28 Nov 2022Fixed
The function `on_lock_algo` and `on_lock_usdc` are declared but never used in the contract.
Open the reportLowBurned token not sent to address(0)Equito Finance Solidity · CertiK · 28 Nov 2022Fixed
The target address to burn token is `address(this)` in function `burn`, instead of sending tokens to the publicly known burned address.
Open the reportLowPotential Reentrancy AttackEquito Finance Solidity · CertiK · 28 Nov 2022Fixed
A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. Variable `erc20Balance` is updated after the call to sending ether `erc20Addr.call{value: amount}("");`. Note that the impact of this issue is smaller than a common reentrancy attack as only validated address is able to trigger the call.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="equito-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us