Fandomdao security record
As of 3 Nov 2026, Fandomdao has 1 audit report on Trustblock, by CertiK, dated 25 Mar 2024. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
Findings9
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 4 | 0 |
| Medium | 0 | 1 | 0 |
| Low | 4 | 0 | 0 |
HighCentralization Risks in DpPool.solFandomDAO · CertiK · 25 Mar 2024Acknowledged
In the contract `DpPool` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and allows the following operations: - withdrawExcessByAdmin(): Allows the caller to withdraw the difference between the contract balance and the `totalSupply`. Only callable by the owner. - withdrawAccount(address account,uint256 amount): Allows the caller to unstake any users` tokens. Only callable by the owner. - setOpen(bool _open): Allows the caller to open or close the Pool. Only callable by the owner. 
Open the reportHighCentralization Risks in TransparentFactory.solFandomDAO · CertiK · 25 Mar 2024Acknowledged
In the contract `TransparentFactory` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and upgrade the contract code of a `proxyAddress`. 
Open the reportHighCentralized Control of Contract UpgradeFandomDAO · CertiK · 25 Mar 2024Acknowledged
In the contract `DpPool`, the role `admin` has the authority to update the implementation contract behind the contract. Any compromise to the `admin` account may allow a hacker to take advantage of this authority and change the implementation contract which is pointed by proxy and therefore execute potential malicious functionality in the implementation contract.
Open the reportHighUnclear Staking BenefitsFandomDAO · CertiK · 25 Mar 2024Acknowledged
The `DpPool` contract has a function for users to stake their tokens. In particular, a user can use `stake` to add `stakeToken` tokens into the contract and `withdraw` or `instantUnstake` to get their tokens back. Since the logic of distributing rewards is performed via a Web2 server, the staking mechanism is highly centralized.
Open the reportMediumIneffective Start Time Check in Staking FunctionFandomDAO · CertiK · 25 Mar 2024Acknowledged
The `DpPool` contract in Solidity contains a modifier `checkStart` intended to restrict staking actions until the pool is officially started, indicated by the `startTime`. However, the `startTime` is hard-coded to zero and cannot be changed, rendering the check always true. This issue could potentially allow users to stake tokens before the intended pool start time, leading to unexpected behavior or advantages for early stakers.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="fandomdao"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us