As of 3 Nov 2026, Galleon DEX has 1 audit report on Trustblock, by Quantstamp, dated 5 May 2021. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Galleon DEX | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 0 | 0 |
| Medium | 0 | 4 | 4 |
| Low | 0 | 7 | 3 |
`GalleonPool.upsertAsset` and `GalleonPool.getMarketShare` assume that the listed tokens' decimals are always lower than 18 decimals. Such implementation will prevent listing tokens with higher decimals since the transactions will throw due to underflow. Please note that the [ERC20 standard](https://eips.ethereum.org/EIPS/eip-20#decimals) does not require the decimals value to be fixed or lower than any specific value.
Open the reportThe fee logic inside the `withdrawInto()` and `withdraw()` functions will always leave assets in the contract, meaning that the last user to withdraw his asset will see his calculated fees being left out in the contract. Depending on the amount left, an attacker can deposit an extremely small amount of tokens (compared to the left out fees) and withdraw the majority of the remaining asset in the pool.
Open the reportThe `GalleonPool.findBalanceAndMultiplier()` and the `GalleonExchangeInterface.invariant()` functions use the price from the call to the [deprecated API function](https://docs.chain.link/docs/deprecated-aggregatorinterface-api-reference/#latestanswer) `oracle.latestAnswer()` of Chainlink. This approach is vulnerable to price manipulation and stale prices according to the Chainlink documentation: 1. [under current notifications](https://docs.chain.link/docs/developer-communications#current-notifications): "if answeredInRound < roundId could indicate stale data." 2. [under historical price data](https://docs.chain.link/docs/historical-price-data#solidity): "A timestamp with zero value means the round is not complete and should not be used."
Open the reportOn L197, the `withdrawInto()` function computes the `invariantFractionIBurned` using `theExchange.fullyDilutedSupply()`, which has been updated after `amount` LP tokens have been burned through `GalleonPool.swapBurn()`. Based on the code comments and the implementation of `GalleonExchangeInterface.withdraw()`, it seems like the correct invariant check needs to be using the initial fully diluted supply before it is updated.
Open the reportBlocked addresses cannot swap, but they can still deposit into the pool, receive LP tokens, and withdraw assets.
Open the reportThe `GalleonPool` pool smart contract allows changes to the exchange interface, deposit contract, and the triage address. However, the functions for these changes do not emit events.
Open the reportWe understand that the intention of Galleon DEX is to use ETH as the numeraire asset and we can also see that in the current list of Chainlink oracles all oracles of the form `<ERC20>/ETH` return 18 decimals. However, there is no guarantee that this will be the case for such Chainlink oracles in the future. The require statement on L151 in `GalleonPool.sol`: `require(oracle.decimals()==18, "Galleon: Invalid oracle");` prevents adding Chainlink price feed contracts which do not have exactly 18 decimals digits. One Chainlink price feed contract which has a value different from 18, namely 8 decimals is the [ETH/USD price feed contract](https://etherscan.io/address/0xb022E2970b3501d8d83eD07912330d178543C1eB#readContract). Many other Chainlink price feed contracts, which do not have 18 decimals can be found [here](https://docs.chain.link/docs/ethereum-addresses/). <br><br> The code inside `GalleonPool.findBalanceAndMultiplier()` assumes that the `latestAnswer()` function of the Chainlink price feed contract always returns a result with 18 decimal digits. However, this is not guaranteed as described above. We also refer to the [FAQ section of the Chainlink documentation](https://docs.chain.link/docs/faq/) where the following question and answer are listed: > **Why is latestAnswer reported at 8 decimals for some contracts, but for other contracts it is reported with 18 decimals?** > >For crypto quotes, 18 decimals is typically used because they usually require more precision. For FX quotes, 8 decimals are used because that is the precision data sources typically report them at. If at some point in time oracles that return a number of decimals different than 18 will be needed and included, it will have a significant impact on all trading activities.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="galleon-dex"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us