Fidelis security record
As of 3 Nov 2026, Fidelis has 1 audit report on Trustblock, by CertiK, dated 15 Feb 2023. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Africa Code Academy: Fidelis | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · skynet.certik.com |
Findings10
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 0 | 1 |
| Low | 6 | 0 | 1 |
HighCentralization Related RisksAfrica Code Academy: Fidelis · CertiK · 15 Feb 2023Fixed
In the contract `approval.teal`, the role `manager` has authority over the following subroutine: * `escrowconfig_2` In the contract `approval.teal`, the role `agent_address` has authority over the following subroutine: * `pull_4` In particular, the `agent_address` can pull any amount of any asset of the contract. Any compromise to the `manager` or `agent_address` accounts may allow a hacker to take advantage of this authority.
Open the reportHighRestrictions on repayment assetsAfrica Code Academy: Fidelis · CertiK · 15 Feb 2023Fixed
In the `repay_3` subroutine, there are checks making sure that the repayment amount (`txna ApplicationArgs 1`) is greater than 0 and less than or equal to the global balance. It is also checked that the sender is actively holding the asset of repayment (`txna Assets 0`). However, the asset of repayment (`txna Assets 0`) is provided by the caller through transaction input, which can be different from the asset that has been borrowed.
Open the reportMediumMissing checks and updates of `loan_state`Africa Code Academy: Fidelis · CertiK · 15 Feb 2023Fixed
We feel that the workflow is as what is shown in the diagram below. Please correct us if there is any misunderstanding.  The current implementation does not match our understanding in the following ways: 1. The current implementation does not check if the `loan_state` is `alive` for the `repay_3` subroutine. 2. After execution of the `reclaim_1` subroutine, the `loan_state` is not updated. One approach is to update back to `openToInvestment`. Another approach is to update it to some new states like `reclaimed`, and let the `reclaimed` state be a final state, etc.
Open the reportLowMissing Txn Basic ChecksAfrica Code Academy: Fidelis · CertiK · 15 Feb 2023Fixed
The smart contract is missing some checks on transactions. In addition, in commit hash `a52d84008a830e74db08f1d1ba2599ee543e5f87`, there are new `RekeyTo == Sender` requirements in subroutines `invest`, `reclaim` and `repay`, which would adding the `Sender` address to the `Auth-Addr` to the signer address.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="fidelis"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us