Fuse security record
As of 22 Oct 2026, Fuse has 1 audit report on Trustblock, by Quantstamp, dated 4 Mar 2021. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Fuse Contracts | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings13
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 2 | 9 |
HighUnset ownerFuse Contracts · Quantstamp · 4 Mar 2021Fixed
Owner is not initialized in `FuseFeeDistrubutor`; all funds withdrawn through `FuseFeeDistrubutor.withdrawAssets` will be sent to `address(0)`.
Open the reportMediumLimited tests and documentation for certain contractsFuse Contracts · Quantstamp · 4 Mar 2021Fixed
In the diff versus existing `open-oracle` code, the newly added `UniswapView.sol` is significantly modified from the existing `UniswapAnchorView.sol`, but does not have corresponding tests. Further, there is little inline documentation making it difficult to assess the diff. In general, this problem is apparent across all repositories (partly due to lack of coverage scripts).
Open the reportLow`_setFuseFee`, `_withdrawFuseFees`, and `_withdrawAdminFees` are callable by any userFuse Contracts · Quantstamp · 4 Mar 2021Fixed
For `_setFuseFee`, although the function will set the fuse fee based on the `fuseAdmin` address regardless of the `msg.sender`, it is not clear if any user should be allowed to invoke the function. As one consequence, spurious `NewFuseFee` event messages could be emitted by any user. It is not clear non-privileged users should be able to invoke the fee withdrawal functions.
Open the reportLow`getSymbolHashIndex` may consume excessive gasFuse Contracts · Quantstamp · 4 Mar 2021Fixed
`UniswapAnchoredView.getSymbolHashIndex` iterates over `_configs` to get the symbol hash index. Depending on the length of the `_configs` array this function can consume excessive gas when executed during a transaction.
Open the reportLowArray not updated on market exitFuse Contracts · Quantstamp · 4 Mar 2021Fixed
Users addresses added in `Comptroller.addToMarketInternal` are not removed later when `Comptroller.exitMarket` logic is executed.
Open the reportLowCheck of positive balances always trueFuse Contracts · Quantstamp · 4 Mar 2021Fixed
In `withdrawAssets()` on L54,60, checks ensure that `balance >= 0`, which always holds.
Open the reportLowFund sent by mistake can be withdrawn by any userFuse Contracts · Quantstamp · 4 Mar 2021Fixed
The implemented internal functions `transferSeizedFunds` and `exchangeAllEthOrTokens` transfer all the contract ether or token balances to the target address. If funds are sent by error to the contract, any user interacting with the contract will be able to take the funds.
Open the reportLowIncorrect return valueFuse Contracts · Quantstamp · 4 Mar 2021Fixed
`FusePoolDirectory.registerPool` does not return the index as expected since the call to the internal function `FusePoolDirectory._registerPool` does not contain a return statement and will always return zero.
Open the reportLowMissing input validationFuse Contracts · Quantstamp · 4 Mar 2021Fixed
The following function should perform additional checks: 1. `UniswapConfig.changeAdmin` should ensure that `newAdmin` is non-zero. 1. `PreferredPriceOracle.constructor` should ensure that both address arguments are non-zero. 1. In `FuseFeeDistributor.sol`, both the `constructor` and `setInterestFeeRate`, the argument `_interestFeeRate` should be validated to be less than `1e18`. 1. In `FusePoolDirectory.sol`, `deployPool` does not ensure that address arguments are non-zero.
Open the reportLowStale oracle priceFuse Contracts · Quantstamp · 4 Mar 2021Fixed
`ChainlinkPriceOracle.getUnderlyingPrice` calls `AggregatorV3Interface.latestRoundData` without checking `startedAt` and `updatedAt` values, meaning that the latest round returned can be obsolete since Chainlink aggregators rely on external nodes to be updated once a request is submitted by one of the sponsors.
Open the reportShow 1 more
LowUnlisted price feed does not throwFuse Contracts · Quantstamp · 4 Mar 2021Fixed
In `ChainlinkPriceOracle` getting the underlying price of a `CToken` using `getUnderlyingPrice` does not verify if the underlying token is listed in `priceFeeds` arrays.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="fuse"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us