IceCreamSwap security record
As of 3 Nov 2026, IceCreamSwap has 9 audit reports by 2 security firms on Trustblock; the latest is by CertiK, dated 6 Jul 2023. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits9
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| IceCreamSwap | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| IceCreamSwap | Security firm: SolidProof | Date: | Scope: Repository at commit da446c3 | No open critical findings | Open · IPFS |
| IceCreamSwap | Security firm: SolidProof | Date: | Scope: Repository at commit cddf38a | No open critical findings | Open · IPFS |
| IceCreamSwap | Security firm: SolidProof | Date: | Scope: Repository at commit a298754 | No open critical findings | Open · IPFS |
| IceCreamSwap | Security firm: SolidProof | Date: | Scope: Repository at commit da446c3 | No open critical findings | Open · IPFS |
| IceCreamSwap | Security firm: SolidProof | Date: | Scope: Repository at commit da446c3 | No open critical findings | Open · IPFS |
| IceCreamSwap | Security firm: SolidProof | Date: | Scope: Repository at commit 77bc187 | No open critical findings | Open · IPFS |
| IceCreamSwap | Security firm: SolidProof | Date: | Scope: Repository at commit 7d0d088 | No open critical findings | Open · IPFS |
| IceCreamSwap | Security firm: SolidProof | Date: | Scope: Repository at commit da446c3 | No open critical findings | Open · IPFS |
Findings64
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 14 | 1 | 3 |
| Low | 46 | 0 | 0 |
MediumCentralization Related RisksIceCreamSwap · CertiK · 6 Jul 2023Acknowledged
In the contract `IceCreamFarm` the role `_owner` has authority over the functions shown in the diagram below.  - `add(uint256 _allocPoint, IERC20 _lpToken, bool _isRegular, bool _withUpdate)`: Adds a new liquidity pool with the specified allocation point and LP token, specifies whether it's a regular pool, and optionally updates all pools. The function can only be called by the contract owner. - `set(uint256 _pid, uint256 _allocPoint, bool _withUpdate)`: Updates the allocation point of a specified pool and optionally updates all pools. The function can only be called by the contract owner. - `burnIce(bool _withUpdate)`: Burns the ICE token and optionally updates all pools. The function can only be called by the contract owner. - `updateIceRate(uint256 _burnRate, uint256 _regularFarmRate, uint256 _specialFarmRate, bool _withUpdate)`: Updates the rate of ICE tokens for burning, regular farming, and special farming, and optionally updates all pools. The function can only be called by the contract owner. - `updateBurnAdmin(address _newBurnAdmin)`: Updates the address of the burn admin. The function can only be called by the contract owner. - `updateWhiteList(address _user, bool _isValid)`: Updates the whitelist status of a user for special pools. The function can only be called by the contract owner. - `changeIceTreasury(address _iceTreasury)`: Changes the address of the ICE treasury. The function can only be called by the contract owner. - `changeIcePerBlock(uint256 _totalIcePerBlock, bool _withUpdate)`: Changes the amount of ICE being distributed per block and optionally updates all pools. The function can only be called by the contract owner. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and update the sensitive settigns or execute sensitive functions of the contract In the contract `IceCreamFarm` the role `boostContract` has authority over the functions shown in the diagram below.  - `updateBoostContract(address _newBoostContract)`: Updates the address of the contract responsible for share boosts. The function can only be called by the account who was granted with boostContract role. Any compromise to the `boostContract` account may allow the hacker to take advantage of this authority and update the sensitive settigns or execute sensitive functions of the contract --- In the contract `PancakeFactory` the role `feeToSetter` has authority over the functions shown in the diagram below.  - `setFeeTo(address _feeTo)`: This function is used to set the address where fees are sent (`feeTo`). The function can only be called by the current `feeToSetter`. - `setFeeToSetter(address _feeToSetter)`: This function is used to change the address that has the privilege to set the `feeTo` address. The function can only be called by the current `feeToSetter`. Any compromise to the `feeToSetter` account may allow the hacker to take advantage of this authority and update the sensitive settigns or execute sensitive functions of the contract --- In the contract `PancakePair` the role `factory` has authority over the functions shown in the diagram below.  - `initialize(address _token0, address _token1)`: This function initializes the token0 and token1 state variables in the contract. It can only be called once by the factory contract during deployment. The function can only be called by the factory contract or account. Any compromise to the `factory` account may allow the hacker to take advantage of this authority and update the sensitive settigns or execute sensitive functions of the contract --- In the contract `SmartChefFactory` the role `_owner` has authority over the functions shown in the diagram below.  - `deployPool(IERC20Metadata _stakedToken, IERC20Metadata _rewardToken, uint256 _rewardPerBlock, uint256 _startBlock, uint256 _bonusEndBlock, uint256 _poolLimitPerUser, uint256 _numberBlocksForUserLimit, address _admin)`: This function deploys a new SmartChefInitializable contract. It verifies that the staking and reward tokens are valid by checking their total supply, and then deploys a new SmartChefInitializable contract with the given parameters. After deployment, it emits a `NewSmartChefContract
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="icecreamswap"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us