Fei Protocol security record
As of 29 Oct 2026, Fei Protocol has 5 audit reports by 2 security firms on Trustblock; the latest is by Consensys, dated 1 Sep 2021. Those reports list 1 open critical finding.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits5
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Fei Protocol v2 Phase 1 | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Fei Protocol Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| Fei Tribechief | Security firm: Consensys | Date: | Scope: Not recorded (see the report) | 1 open critical finding | Open · diligence.security |
| Fei Protocol Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 5 critical findings, fixed | Open · blog.openzeppelin.com |
| Fei Protocol | Security firm: Consensys | Date: | Scope: Not recorded (see the report) | 2 open critical findings | Open · diligence.security |
Findings74
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 1 | 0 | 6 |
| High | 6 | 0 | 2 |
| Medium | 16 | 0 | 5 |
| Low | 30 | 0 | 8 |
CriticalTribalChief - A wrong user.rewardDebt value is calculated during the withdrawFromDeposit function callFei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportHighCollateralizationOracle - Fei in excluded deposits contributes to userCirculatingFeiFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportHighStableSwapOperatorV1 - resistantFei value is not correct in the resistantBalanceAndFei functionFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportHigh[H01] Fei reweight and stabilization may not react to price swingsFei Protocol Audit · OpenZeppelin · 2 Jul 2021Open
The report gives no description here.
Open the reportHigh[H02] Introduction of additional BondingCurves creates period of volatilityFei Protocol Audit · OpenZeppelin · 2 Jul 2021Open
The report gives no description here.
Open the reportHigh[H03] Inconsistent use of oraclesFei Protocol Audit · OpenZeppelin · 2 Jul 2021Open
The report gives no description here.
Open the reportHigh[H03] Incentive to support the peg decays with volatilityFei Protocol Audit · OpenZeppelin · 5 Feb 2021Open
The report gives no description here.
Open the reportMediumBalancerLBPSwapper - init() can be front-run to potentially steal tokensFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportMediumChainlinkOracleWrapper - latestRoundData might return stale resultsFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportMediumCollateralizationOracleWrapper - the deviation threshold check in update() always returns falseFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportShow 10 more
MediumPCVEquityMinter and BalancerLBPSwapper - desynchronisation raceFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportMediumStableSwapOperatorV1 - FEI tokens in the contract are not considerred as protocol-ownedFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportMediumStableSwapOperatorV1 - the _minLpOut value is not accurateFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportMedium[M01] Errors and omissions in events throughout codebaseFei Protocol Audit · OpenZeppelin · 2 Jul 2021Open
The report gives no description here.
Open the reportMedium[M02] UniswapPCVDeposit can burn PCV FEI without Burner roleFei Protocol Audit · OpenZeppelin · 2 Jul 2021Open
The report gives no description here.
Open the reportMedium[M03] Lack of input validationFei Protocol Audit · OpenZeppelin · 2 Jul 2021Open
The report gives no description here.
Open the reportMedium[M05] Incorrect use of Time-Weighted Average PricesFei Protocol Audit · OpenZeppelin · 2 Jul 2021Open
The report gives no description here.
Open the reportMediumEthCompoundPCVDeposit - should provide means to recover ETHFei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportMediumTribalChief - Setting the totalAllocPoint to zero shouldn’t be allowedFei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportMediumTribalChief - Unlocking users’ funds in a pool where a multiplier has been increased is missingFei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportShow 10 more
MediumTribalChief - Unsafe down-castingsFei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportMedium[M01] Malicious actors can lock all FEI and TRIBE in the GenesisGroupFei Protocol Audit · OpenZeppelin · 5 Feb 2021Open
The report gives no description here.
Open the reportMedium[M06] Incentive does not initialize when Ether depreciatesFei Protocol Audit · OpenZeppelin · 5 Feb 2021Open
The report gives no description here.
Open the reportLowBalancerLBPSwapper - tokenSpent and tokenReceived should be immutableFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportLowCollateralizationOracle - misleading commentsFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportLowCollateralizationOracle - missing events and incomplete event informationFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportLowCollateralizationOracle - potentially unsafe castsFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportLowCollateralizationOracle - swapDeposit should call internal functions to remove/add depositsFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportLowFeiTimedMinter - constructor does not enforce the same boundaries as setter for frequencyFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportLowNo emergency exit strategy for BalancerLBPSwapperFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportShow 10 more
LowRateLimited - Contract starts with a full buffer at deploymentFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportLowRe-initialization of the Balancer pool is potentially possibleFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportLowStableSwapOperatorV1 - the contract relies on the 1$ price of every token in 3poolFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportLowThe BalancerLBPSwapper may not have enough Tribe tokensFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportLowTribeReserveStabilizer - different minting proceduresFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportLowUpdate NatspecFei Protocol v2 Phase 1 · Consensys · 1 Sep 2021Open
The report gives no description here.
Open the reportLow[L01] Duplicate definitionsFei Protocol Audit · OpenZeppelin · 2 Jul 2021Open
The report gives no description here.
Open the reportLow[L04] Role definition differs from implementationFei Protocol Audit · OpenZeppelin · 2 Jul 2021Open
The report gives no description here.
Open the reportLowCompoundPCV - documentation & testingFei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportLowCompoundPCVDepositBase - verify provided CToken address is actually a CTokenFei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportShow 10 more
LowEthCompoundPCVDeposit - stick to upstream interface contract namesFei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportLowTribalChief - duplicate import SafeERC20Fei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportLowTribalChief - Governor decrease of pool’s allocation point should unlock depositors’ fundsFei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportLowTribalChief - governorAddPoolMultiplier should emit a PoolLocked eventFei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportLowTribalChief - immutable vs constantFei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportLowTribalChief - new block reward retrospectively takes effect on pools that have not been updated recentlyFei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportLowTribalChief - resetRewards should emit an eventFei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportLowTribalChief - updatePool invocation inside _harvest should be moved to harvest insteadFei Tribechief · Consensys · 1 Jul 2021Open
The report gives no description here.
Open the reportLow[L02] Authorized burners can burn FEI balances without an amount restrictionFei Protocol Audit · OpenZeppelin · 5 Feb 2021Open
The report gives no description here.
Open the reportLow[L04] Multiple outdated Solidity versions in useFei Protocol Audit · OpenZeppelin · 5 Feb 2021Open
The report gives no description here.
Open the reportShow 3 more
Low[L06] Not using SafeMath and SafeCastFei Protocol Audit · OpenZeppelin · 5 Feb 2021Open
The report gives no description here.
Open the reportLow[L08] Re-implementing ECDSA signature recoveryFei Protocol Audit · OpenZeppelin · 5 Feb 2021Open
The report gives no description here.
Open the reportLow[L09] Transfers are not checked for successFei Protocol Audit · OpenZeppelin · 5 Feb 2021Open
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="fei-protocol"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us