Gradient Protocol security record
As of 3 Nov 2026, Gradient Protocol has 1 audit report on Trustblock, by CertiK, dated 1 Apr 2024. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Gradientprotocol. | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings6
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 4 | 0 |
| Medium | 0 | 1 | 0 |
| Low | 0 | 1 | 0 |
HighCentralization Risks in GradientERC20.solGradientprotocol. · CertiK · 1 Apr 2024Acknowledged
In the contract `Gradient` the role `AUX_ADMIN` has authority over the functions shown in the diagram below. Any compromise to the `AUX_ADMIN` account may allow the hacker to take advantage of this authority and change fee exempt address, change pair address, change threshold and change fee percentage.  In the contract `Gradient` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and change fee exempt address, change pair address, change threshold and change fee percentage, change token receive address and transfer tokens/ETH out of the contract. 
Open the reportHighCentralized Token Holding Position RiskGradientprotocol. · CertiK · 1 Apr 2024Acknowledged
In function `_swapTokensByPair`, `GDT` tokens are swapped to `currentPair.base` token, which is set by the admin. These tokens are subsequently sent to the tributeHolder wallet. As a result, over time the tributeHolder address will accumulate a significant portion `GDT`. The mishandling of its private key can have devastating consequences for the project as a whole.
Open the reportHighInitial Token DistributionGradientprotocol. · CertiK · 1 Apr 2024Acknowledged
All of the GDT tokens are sent to the contract deployer. This is a centralization risk because the deployer can distribute tokens without obtaining the consensus of the community. Any compromise to the deployer address may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.
Open the reportHighWithdrawal Centralization RiskGradientprotocol. · CertiK · 1 Apr 2024Acknowledged
In the contract `Gradient`, the owner has the authority to withdraw all tokens from the contract. ```solidity=124 function rescueTokens(address recipient, address token, uint amount) public { require( hasRole(DEFAULT_ADMIN_ROLE, msg.sender) , "Insufficient privileges" ); IERC20(token).transfer(recipient, amount); } ``` Any compromise to the owner account may allow a hacker to take advantage of this authority and withdraw tokens from the contract.
Open the reportMediumUnreasonable Fee LimitationGradientprotocol. · CertiK · 1 Apr 2024Acknowledged
The maximum fee rate can be set to 100%, in which case all of the user's transferred Tokens will be swapped and sent to tributeHolder.
Open the reportLowNo Slippage CheckGradientprotocol. · CertiK · 1 Apr 2024Acknowledged
A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by backrunning (after the transaction being attacked) a transaction to sell the asset. The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large: - router.swapExactTokensForTokensSupportingFeeOnTransferTokens
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="gradient"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us