Fathom security record

As of 2 Nov 2026, Fathom has 2 audit reports by 1 security firm on Trustblock; the latest is by OXORIO, dated 19 Jan 2024. Those reports list 3 criticals acknowledged and not fixed.

Critical findings
3 criticals acknowledged, not fixed
Reported in “Fathom Stablecoin” by OXORIO, Jan 2024. The team acknowledged all 3. See the findings
Open the latest report
Your label, live
Get the label for your site

Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.

Audits2

Newest first

AuditSecurity firmDateScopeCritical findingsReport
Fathom StablecoinSecurity firm: OXORIODate: Scope: Repository at commit 3768c873 criticals acknowledged, not fixedOpen · audits.oxor.io
Fathom DAOSecurity firm: OXORIODate: Scope: Repository at commit 5e9f3a28 critical findings, fixedOpen · audits.oxor.io

Findings107

Statuses are the security firm’s own, from each report.

SeverityOpenAcknowledgedFixed
Critical038
High0425
Medium01119
Low01324
CriticalAdding a new owner doesn't change necessary amount of signatures in MultiSigWalletFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
CriticalCalling the updateConfig function may block the work of the StakingHandlers contractFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
CriticalChanging the timelock address may cause re-execution of the proposals in GovernorTimelockControlFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
CriticalRemoving owner without revokeConfirmation transaction in MultiSigWalletFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
CriticalThe initVault and initAdminAndOperator functions can be initialized from any address in the VaultPackage contractFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
CriticalThere is no check that stream is active in the StakingHandler contractFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
CriticalThere is no function that implements the _cancel proposal in MainTokenGovernorFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
CriticalThere's no owners array length validation in the constructor of MultiSigWalletFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighAdmin role can be revoked forever by mistake in VMainTokenFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighCalling initializeStaking in the StakingHandlers contract does not allocate rewards for MAIN_STREAM in VaultPackageFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
Show 10 more
HighGovernance can delete TimelockAdmin and the contract will lose its control in TimelockControllerFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighIn MultiSigWallet there's no parameter defining minimum amount of signaturesFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighIt is possible for attacker to create active locks to force users to reach the lock limit in StakingHandlersFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighIt is possible to set a null address in GovernorTimelockControl when updating timelockFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighMINTER_ROLE and WHITELISTER_ROLE have the same value in the VMainTokenFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighPenalty can be bigger than stake in the StakingInternalsFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighprohibitedEarlyWithdraw is not set to false for lockid after unlocking in StakingHandlersFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighShare weight drop formula is incorrect in StakingInternalsFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighThere is a DoS possibility when calling updateVault in the StakingHandlers contractFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighThere is a possibility for a manager to remove all streams in order to steal all pending rewards in StakingHandlersFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
Show 10 more
HighThere is no emergency shutdown mode in GovernorFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighThere is no emergency suspension of the rewards payment in the VaultPackage contractFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighThere is no option to migrate to another contract in the VaultPackage contractFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighThere is no possibility to transfer standard ERC20 tokens from the Governance balance in MainTokenGovernorFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighThere is no possibility to update multisig in GovernorFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighThere is no validation for maxTargets when executing in GovernorFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighThere is no validation for null values for newQuorumNumerator in GovernorVotesQuorumFractionFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighTokens that get into the VaultPackage balance can be used to withdraw rewards in the contract StakingHandlerFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighTransaction does not have a lifetime parameter in MultiSigWalletFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighTransaction should be marked as executed if the call failsFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
Show 10 more
HighUnsafe use of the transfer and transferFrom functions in StakingHandlers and VaultPackageFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighUpdating rpsDuringLastClaimForLock for inactive stream in the StakingInternals contractFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
HighWhen MINTER_ROLE is added to VMainToken, the isWhiteListed list does not updateFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
MediumCasting to types in unsafe wayFathom Stablecoin · OXORIO · 19 Jan 2024Fixed

The report gives no description here.

Open the report
MediumDisable initializers in upgradable contractsFathom Stablecoin · OXORIO · 19 Jan 2024Fixed

The report gives no description here.

Open the report
MediumfeeRate is not limited in FlashMintModuleFathom Stablecoin · OXORIO · 19 Jan 2024Fixed

The report gives no description here.

Open the report
MediumOutdated typing in FixedSpreadLiquidationStrategyFathom Stablecoin · OXORIO · 19 Jan 2024Fixed

The report gives no description here.

Open the report
MediumRedundant check for totalStablecoinIssued in multiple contractsFathom Stablecoin · OXORIO · 19 Jan 2024Fixed

The report gives no description here.

Open the report
MediumA missing check that tokens are on the balance when calling the payRewards function in the VaultPackage contractFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
MediumconfirmProposal is possible for both active and inactive proposals in GovernorFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
Show 10 more
MediumIncorrect processing of contract modifiers Initializable in the StakingHanders contractFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
MediumIt is possible for any user to call createStream in the StakingHandlers contractFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
MediumIt is possible to remove tokens that are used by another contract in VaultPackageFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
MediumMissing validation, that the bytecode of address _to did not change while running a transaction in MultiSigWalletFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
MediumNo parameter check when adding transaction in MultiSigWalletFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
MediumPossible overflow with calculationsFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
MediumThere is no check for the msg.value value available for execution in Governor and TimelockControllerFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
MediumThere is no check for zero in GovernorSettings._setProposalThresholdFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
MediumThere is no check for zero value for _token, _multiSig and _timelock in Governor, GovernorTimelockControl, MainTokenGovernorFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
MediumThere is no limit on the number of proposals for one proposer in GovernorFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
Show 10 more
MediumThere is no time limit for executing proposal in GovernorFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
MediumThere's no ETH balance validation when adding a non-zero transaction _value in MultiSigWalletFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowAddress imported instead of AddressUpgradeable in BookKeeperFathom Stablecoin · OXORIO · 19 Jan 2024Fixed

The report gives no description here.

Open the report
LowMissing require check in FlashMintModuleFathom Stablecoin · OXORIO · 19 Jan 2024Fixed

The report gives no description here.

Open the report
LowObsolete comments in PositionManagerFathom Stablecoin · OXORIO · 19 Jan 2024Fixed

The report gives no description here.

Open the report
LowRedundant ImportsFathom Stablecoin · OXORIO · 19 Jan 2024Fixed

The report gives no description here.

Open the report
LowTypo in error message in FixedSpreadLiquidationStrategyFathom Stablecoin · OXORIO · 19 Jan 2024Fixed

The report gives no description here.

Open the report
LowTypo in PositionManagerFathom Stablecoin · OXORIO · 19 Jan 2024Fixed

The report gives no description here.

Open the report
LowTypo in several contractsFathom Stablecoin · OXORIO · 19 Jan 2024Fixed

The report gives no description here.

Open the report
LowUnsafe usage of abi.encodeWithSelector in SafeTokenFathom Stablecoin · OXORIO · 19 Jan 2024Fixed

The report gives no description here.

Open the report
Show 10 more
Low_minDelay can be set to zero in TimelockControllerFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowIncorrect status check in execute function in GovernorFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowMisleading check (scheduleTimeLength > 0) in the RewardsCalculatorFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowNon-optimal packing of the Transaction structure in MultiSigWalletFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowNon-optimal storage layout for Stream struct in StakingStructsFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowRedundant check for maxDepositAmount > 0 in RewardsCalculatorFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowThe addSupportedToken and removeSupportedToken calls have an redundant pausable modifier in the VaultPackage contractFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowThere are no checks that admin, proposers and executors are not zero addresses in TimelockControllerFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowThere is a redundant initialized check in VMainTokenFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowThere is a typo in a comment in StakingInternalsFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
Show 6 more
LowThere is redundant code in the VMainToken contractFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowThere's no logging of reverted transactions in MultiSigWalletFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowUnused constant ONE_MONTH in StakingGettersHelperFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowUnused import of ReentracyGuard in StakingHandlersFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowUnused import of StakingStructs in StakingStorageFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report
LowСustom initializer modifier is used instead of one from OpenZeppelinFathom DAO · OXORIO · 18 Jan 2023Fixed

The report gives no description here.

Open the report

Contracts

No deployed address is recorded for these audits.

The reports name a repository or files. Open a report to see its scope.

The repositories and files the reports name

Show this on your site

Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.

Content

Facts

Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.

Fixed as
Language

Style

Layout
Theme
Accent
Corners

Format

Size
Date
Embed as
HTML
<head>
<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
</head>
<body>
<div
data-tb-project-widget
data-tb-project-slug="fathom"
></div>
</body>

Paste the code where the label should appear. It uses no API credit and updates by itself.

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us