Fetch.ai security record
As of 3 Nov 2026, Fetch.ai has 2 audit reports by 1 security firm on Trustblock; the latest is by CertiK, dated 12 Feb 2021. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Fetch.ai - Atomix Smart Contracts | Security firm: CertiK | Date: | Scope: Files named in the report | 4 critical findings, fixed | Open · skynet.certik.com |
| Fetch Token | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings44
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 4 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 7 |
| Low | 4 | 0 | 29 |
CriticalLack of access restriction allows overriding staFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public onRegistryUpdate function in the InterestManager contract does not implement access restriction, which allows anyone to call the function and supply their own IContractRegistry value, pausing the system and effectively overriding the tokenValueStorageContract , rateModelLPContract , rateModelLLContract , lendingPoolContract , loanLiquidatorContract , utilizationRatioContract and spread state variables with the sender's own supplied values.
Open the reportCriticalLack of access restriction allows overriding staFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public onRegistryUpdate function in the LendingPoolStorageModifier contract does not implement access restriction, which allows anyone to call the function and supply their own IContractRegistry value, pausing the system and effectively overriding the interestManagerContract and lendingPoolStorageContract state variables with the sender's own supplied values.
Open the reportCriticalLack of access restriction allows overriding statFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public onRegistryPostUpdate function in the InterestManager contract does not implement access restriction, which allows anyone to call the function and supply their own IContractRegistry value, unpausing the system if the paused state has changed and initializing the tokenValueStorage with their own values if it has not already been initialized.
Open the reportCriticalLack of access restriction allows overriding statFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public onRegistryUpdate function in the LendingPool contract does not implement access restriction, which allows anyone to call the function and supply their own IContractRegistry value, pausing the system and effectively overriding the actContract , stableCoinContract , breachMonitorContract , lendingPoolStorageContract , rateModelLPContract , tokenValueStorageContract , xSCContract , tokenizerContract , spread , lendingPoolWalletAddress , spreadDestinationWallet , breachAddress and lendingPoolStorageModifierContract state variables with the sender's own supplied values.
Open the reportMediumContradictory requirementFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The private getFracLookup function in the InterestCalculator contract contains a contradictory requirement that the supplied utilisationRatio uint256 parameter is greater than or equal to zero, which will always be true regardless of the supplied value due to being unsigned.
Open the reportMediumPotential integer truncationFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public getBorrowerLnAPRRate function in the InterestCalculator contract performs primitive arithmetic without requiring the values to be valid beforehand, which can result in over/underflow or multiplying/dividing by zero: ```solidity borrowingRateData[minIndex] + (fracIndex * (borrowingRateData[maxIndex] - borrowingRateData[minIndex])) / (10**18) ```
Open the reportMediumUnused result from call to transferFromFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The external borrow function in the LendingPool contract ignores the value returned from the call to the transferFrom function.
Open the reportMediumUnused result from call to transferFromFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The external deposit function in the LendingPool contract ignores the value returned from the call to the transferFrom function.
Open the reportMediumUnused result from call to transferFromFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The external redeem function in the LendingPool contract ignores the value returned from the call to the transferFrom function.
Open the reportMediumUnused result from call to transferFromFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The external repayAll function in the LendingPool contract ignores the value returned from the call to the transferFrom function.
Open the reportShow 10 more
MediumUnused result from call to transferFromFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public transferSpread function in the LendingPool contract ignores the value returned from the call to the transferFrom function.
Open the reportLowConstant variables not following naming conventioFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The secsPerYear , a0 , a1 , a2 , a3 , a4 , a5 and numBins constant variables in the InterestCalculator contract are not named in upper-case with underscores, which goes against the recommended Solidity naming conventions.
Open the reportLowFunction should be re-declared as externalFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public getLoanDetails function in the PoolStorageBase contract should be redeclared as external.
Open the reportLowFunctions should be re-declared as externalFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public getSPRRates and getLoanSPRRate functions in the InterestManager contract should be re-declared as external.
Open the reportLowFunctions should be re-declared as externalFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public getTotalSCDepositValue , getXSCValue , isDebtOverLimit , withdrawAct functions in the LendingPool contract should be re-declared as external.
Open the reportLowFunctions should be re-declared as externalFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public uploadRateData , getBorrowerAPRRate , minBorrowingApr and maxBorrowingApr functions in the InterestCalculator contract is should be re-declared as external.
Open the reportLowPotential for minor re-entrancy; Out-of-order evFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The external repay function in the LendingPool contract has the potential for re-entrancy due to transfering from the supplied payee address parameter to the arbitrary lendingPoolWalletAddress address, which can lead to emitting events out of order.
Open the reportLowPotential for minor re-entrancy; Out-of-order eveFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The external borrow function in the LendingPool contract has the potential for re-entrancy due to transfering from the arbitrary lendingPoolWalletAddress address to msg.sender , which can lead to emitting events out of order.
Open the reportLowPotential for minor re-entrancy; Out-of-order eveFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The external deposit function in the LendingPool contract has the potential for re-entrancy due to transfering from the supplied account address parameter to the arbitrary lendingPoolWalletAddress address, which can lead to emitting events out of order.
Open the reportLowPotential for minor re-entrancy; Out-of-order eveFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The external redeem function in the LendingPool contract has the potential for re-entrancy due to transfering from the arbitrary lendingPoolWalletAddress address to the supplied account address parameter, which can lead to emitting events out of order.
Open the reportShow 10 more
LowPotential for minor re-entrancy; Out-of-order eveFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The external repayAll function in the LendingPool contract has the potential for reentrancy due to transfering from the supplied payee address parameter to the arbitrary lendingPoolWalletAddress address, which can lead to emitting events out of order.
Open the reportLowPotential for minor re-entrancy; Out-of-order eveFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public depositAct function in the LendingPool contract has the potential for reentrancy due to transfering from msg.sender to the arbitrary lendingPoolWalletAddress address, which can lead to emitting events out of order.
Open the reportLowPotential for minor re-entrancy; Out-of-order eveFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public transferSpread function in the LendingPool contract has the potential for reentrancy due to transfering from the arbitrary lendingPoolWalletAddress to the arbitrary spreadDestinationWallet address, which can lead to emitting events out of order.
Open the reportLowPotential for minor re-entrancy; Out-of-order eveFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public withdrawAct function in the LendingPool contract has the potential for reentrancy due to transfering from the arbitrary lendingPoolWalletAddress address to msg.sender , which can lead to emitting events out of order.
Open the reportLowPotential integer underflowFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public getAvailableBorrowerLimit function in the LendingPool contract performs a primitive subtraction on the local totalBorrowingLimit and loanValue variables without checking if their values are valid beforehand, which has the potential for underflow.
Open the reportLowRedundant array length calculationFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public uploadRateData function in the InterestCalculator contract queries the length of the supplied rateData array parameter multiple times, which is inefficient.
Open the reportLowRedundant calculationFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The private getFracLookup function in the InterestCalculator contract performs a redundant calculation on lines 113 and 117 of subtracting 1 from the numBins state variable and multiplying it by the supplied utilisationRatio parameter: ```solidity uint256 _minIndex = (numBins.sub(1)).mul(utilisationRatio).div(10**18); ``` ```solidity uint256 _fracIndex = (numBins.sub(1)).mul(utilisationRatio).sub(_minIndex.mul(10**18)); ```
Open the reportLowUnnecessary usage of SafeMath functionalityFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public getUtilizationRatio function in the LendingPool contract performs zerochecks on the local iSCTotalValue and xSCTotalValue variables before utilizing the SafeMath.mul and SafeMath.div functions, which is unnecessary and inefficient.
Open the reportLowUnused named return variableFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The private generateHashNames function in the LendingPool contract declares a named hashNames return variable, yet declares a local _hashNames variable and explicitly returns that instead of utilizing the return variable, which is inefficient.
Open the reportLowUnused named return variableFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public getLoanSPRRate function in the InterestManager contract declares a named loanSPR return variable, yet it is never referenced and an explicit return statement is used instead, which is inefficient.
Open the reportShow 10 more
LowUnused named return variablesFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The external calcNewValues function in the RateModelLP contract declares named finalValueIn and finalValueOut return variables, yet declares local _finalValueIn and _finalValueOut variables and explicitly returns those instead of using the return variables, which is inefficient.
Open the reportLowUnused named return variablesFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The private generateHashNames and generateAllHashNames functions in the InterestManager contract declares a named hashNames return variable, yet declares a local _hashNames variable and explicitly returns that instead of utilizing the return variable, which is inefficient.
Open the reportLowUnused named return variablesFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The private getFracLookup function in the InterestCalculator contract declares named minIndex , maxIndex and fracIndex return variables, yet declares local _minIndex , _maxIndex and _fracIndex variables and explicitly returns those instead of using the return variables, which is inefficient.
Open the reportLowUnused named return variablesFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The public getSPRRates function in the InterestManager contract declares named lenderLPSPR , borrowerLPSPR and borrowerLLSPR return variables, yet declares local lenderLPSPR , borrowerLPSPR and borrowerLLSPR variables and returns those instead, which is inefficient.
Open the reportLowUnused result from call to transferFromFetch.ai - Atomix Smart Contracts · CertiK · 12 Feb 2021Fixed
The external repay function in the LendingPool contract ignores the value returned from the call to the transferFrom function.
Open the reportLowFunction visibility can be `external`Fetch Token · CertiK · 5 Oct 2020Fixed
The functions which are never called internally from within the contract should have `external` visibility. The functions on the aforementioned lines have `public` visibility which can be safely changed to `external` .
Open the reportLowSubstitution of require call with ModifierFetch Token · CertiK · 5 Oct 2020Fixed
The aformentioned `require` call can be converted into a modifier to increase the legibility of the code.
Open the reportLowSubstitution of require calls with ModifierFetch Token · CertiK · 5 Oct 2020Fixed
The `require` calls on the aforementioned lines can be converted into a modifier to aid readability and maintainability of the code by avoiding code duplication.
Open the reportLowUnlocked Compiler VersionFetch Token · CertiK · 5 Oct 2020Fixed
The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one
Open the reportLowvirtual modifier can be removedFetch Token · CertiK · 5 Oct 2020Fixed
The functions on the aforementioned lines have `virtual` modifiers and yet they are the final implementations in the contract's inheritance chain as there are no functions overriding any of them. As these functions are not being overriden, the `virtual` modifiers can be safely removed from each of the functions
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="fetchai"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us