As of 3 Nov 2026, Fodl Finance has 1 audit report on Trustblock, by Quantstamp, dated 13 Oct 2021. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Fodl | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 2 | 5 | 4 |
When creating a new account, the `create2` salt is defined as `uint256 salt = uint256(keccak256(abi.encodePacked(msg.sender, fodlNFT.balanceOf(msg.sender))));`. Since the NFT is an ERC721, it may be transferred to a different address. Suppose the user has created one account, but then transfers it to a different address (such that `fodlNFT.balanceOf(user)` is reduced back to 0). On a second invocation of `createAccount()`, the salt `uint256(keccak256(abi.encodePacked(user, 0)))` will be exactly the same as the first invocation, and the `create2` call will fail.
Open the reportThe clone-and-own approach involves copying and adjusting open source code at one's own discretion. From the development perspective, it is initially beneficial as it reduces the amount of effort. However, from the security perspective, it involves some risks as the code may not follow the best practices, may contain a security vulnerability, or may include intentionally or unintentionally modified upstream libraries. Rather than the clone-and-own approach, a good industry practice is to use a framework for managing library dependencies. This eliminates the clone-and-own risks yet allows for following best practices, such as, using libraries.
Open the report1. In `StopLossStorage.sol` on L25, the `unwindFactor` is claimed to range from “1 to 100”. However, `SimplePositionStopLossConnector.configureStopLoss()` checks that `unwindFactor <= MANTISSA`. A similar issue exists for `slippageIncentive`. 1. In `SimplePositionStopLossConnector.sol` on L52,54: ``` // check that collateralUsageLimit <= collateralUsage require(getCollateralUsageFactor() > stopLossConfiguration.collateralUsageLimit, 'SLC5'); ``` Either the first line should use `<=`, or the second line should use `>=` to match the comment. Note that L161 uses the same constraint.
Open the report`create2` is used in the context where there is a need to predict the contract address before deploying it. There is no mention in the documentation for such a feature, yet, the opcode is still used in `createAccount()` function.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="fodl-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us