FarmersOnly Layer 2 security record

Avalanchefarmersonly.farm

As of 3 Nov 2026, FarmersOnly Layer 2 has 3 audit reports by 1 security firm on Trustblock; the latest is by Paladin, dated 25 Nov 2021. Those reports list no open critical findings. It also holds 8 deployed contracts on 1 chain.

Critical findings
No open critical findings
Across 3 reports.
Open the latest report
Your label, live
Get the label for your site

Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.

Audits3

Newest first

AuditSecurity firmDateScopeCritical findingsReport
Audit Report

Audit

Security firm: PaladinDate: Scope: 2 addresses on AvalancheNo open critical findingsOpen · paladinsec.co
Audit Report

Audit

Security firm: PaladinDate: Scope: 2 addresses on AvalancheNo open critical findingsOpen · paladinsec.co
Audit Report

Audit

Security firm: PaladinDate: Scope: 4 addresses on AvalancheNo open critical findingsOpen · paladinsec.co

Findings62

Statuses are the security firm’s own, from each report.

SeverityOpenAcknowledgedFixed
Critical000
High103
Medium115
Low12426
HighUsers can avoid withdrawal fee through emergencyWithdrawAudit Report · Paladin · 25 Nov 2021Fixed

The report gives no description here.

Open the report
HighIf the staked token is equal to the reward token, the owner can drain the staked tokens with emergencyRewardWithdrawAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
HighThe reward distribution mechanism is wrongly definedAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
Medium0x0 pools can still be added even after the setup is completedAudit Report · Paladin · 25 Nov 2021Fixed

The report gives no description here.

Open the report
MediumKing pools could still be added after isKingRotationActive is set to false to potentially create more pools with a 20% withdrawal feeAudit Report · Paladin · 25 Nov 2021Fixed

The report gives no description here.

Open the report
MediumrotateKing could cause deposits and withdrawals to rotate if it is not called for six hoursAudit Report · Paladin · 25 Nov 2021Fixed

The report gives no description here.

Open the report
MediumMaximum supply cap logic is wrongly defined, causing the token to mint either too much or too little potentially causing deposits and withdrawals to revertAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
MediumThe deposit, withdraw and emergencyWithdraw functions do not have reentrancy guardsAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowKing allocation points can still be adjusted manually by governanceAudit Report · Paladin · 25 Nov 2021Fixed

The report gives no description here.

Open the report
LowsetAllocPoint, setKingPoolMul and disableKingRotation might update rewards in hindsightAudit Report · Paladin · 25 Nov 2021Fixed

The report gives no description here.

Open the report
Show 10 more
LowUnnecessary else branch in withdrawAudit Report · Paladin · 25 Nov 2021Fixed

The report gives no description here.

Open the report
LowAdding an EOA or a non-token contract as a pool will break updatePool, massUpdatePools and updateEmissionRateAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowContract contains unused referral code mechanism which could be accidentally set to block depositsAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowContracts contains multiple occurrences of code that has been commented outAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
Lowdeposit, withdraw, set, emergencyWithdraw, setStartTime, updateEmissionRate, setFeeAddress, dev and getHarvestUntil functions can be made externalAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowLack of events for setRewardPerTime and setBonusEndTimeAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowMAX_EMISSION_RATE and EMISSION_RATE can be declared as a constantAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
Lowmint function can be used to pre-mint large amounts of tokens before ownership is transferred to the MasterchefAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
Lowmsg.sender is unnecessarily cast to address(msg.sender)Audit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowSetting devAddress and feeAddress to the zero address will break updatePool and deposit functionality respectivelyAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
Show 10 more
LowstakeToken, rewardToken and startTime can be declared as a immutableAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowThe BONUS_MULTIPLIER variable is not functionalAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowThe deposit and withdraw functions can be made externalAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowThe msg.sender is unnecessarily cast to address(msg.sender)Audit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowThe pendingTomato function will revert if totalAllocPoint is zeroAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowThe poolInfo is unnecessarily declared as an array making totalAllocPoint redundant as wellAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowThe set function error still references the add functionAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowThe setRewardPerTime function can be set to an excessive emission rateAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowThe setRewardPerTime should include an updatePool(0); before the changeAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowThe StartTimeChanged event wrongly emittedAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
Show 4 more
LowThe updatePool function will revert if totalAllocPoint is zeroAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowThere are no sanity checks in the setReferralAddress functionAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
Lowtomato can be declared as immutableAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report
LowTypographical errorsAudit Report · Paladin · 18 Oct 2021Fixed

The report gives no description here.

Open the report

Contracts8

AddressChainSource code
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source

Show this on your site

Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.

Content

Facts

Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.

Fixed as
Language

Style

Layout
Theme
Accent
Corners

Format

Size
Date
Embed as
HTML
<head>
	<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
</head>
<body>
	<div
		data-tb-project-widget
		data-tb-project-slug="farmersonly-layer-2"
	></div>
</body>

Paste the code where the label should appear. It uses no API credit and updates by itself.

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us