Idle Finance security record
As of 29 Oct 2026, Idle Finance has 3 audit reports by 2 security firms on Trustblock; the latest is by Consensys, dated 1 Jun 2021. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Idle Finance | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Idle Finance | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Idle Governance | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings56
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 4 | 0 | 4 |
| Low | 8 | 16 | 24 |
MediumIdleCDO._deposit() allows re-entrancy from hookable tokens.Idle Finance · Consensys · 1 Jun 2021Open
The report gives no description here.
Open the reportMediumIdleCDO.harvest() allows price manipulation in certain circumstancesIdle Finance · Consensys · 1 Jun 2021Open
The report gives no description here.
Open the reportMediumIdleCDO.virtualPrice() and _updatePrices() yield different prices in a number of casesIdle Finance · Consensys · 1 Jun 2021Open
The report gives no description here.
Open the reportMediumWrong comparison between lengthsIdle Finance · Quantstamp · 23 Apr 2021Open
On L148 in `IdleTokenGovernance.sol` we can see the following `require` statement: `require(_newGovTokensEqualLen.length >= protocolTokens.length, '!EQ');` From the other occurrences of `!EQ` we believe that it should indicate that the 2 terms being compared are not equal, which is different from what the Boolean expression in that `require` statement is comparing, that is the comparison is actually checking if the length of the `_newGovTokensEqualLen` is higher-or-equal to the length of `protocolTokens`.
Open the reportLowClearly communicate admin capabilitiesIdle Finance · Consensys · 1 Jun 2021Open
The report gives no description here.
Open the reportLowDocumentation for formulas and price/reward calculationsIdle Finance · Consensys · 1 Jun 2021Open
The report gives no description here.
Open the reportLowIdleCDO.virtualPrice() & _updatePrices() too complicated to verifyIdle Finance · Consensys · 1 Jun 2021Open
The report gives no description here.
Open the reportLowMissing Sanity checksIdle Finance · Consensys · 1 Jun 2021Open
The report gives no description here.
Open the reportLowPrevent initialization of implementation contractsIdle Finance · Consensys · 1 Jun 2021Open
The report gives no description here.
Open the reportLowPrevent zero amount transfers/mintingIdle Finance · Consensys · 1 Jun 2021Open
The report gives no description here.
Open the reportShow 2 more
LowInconsistent array lengths breaks invariantIdle Finance · Quantstamp · 23 Apr 2021Open
**Note:** this issue is essentially the same as QSP-24 from a previous audit; the fix appears to have been reverted. The length of the `allAvailableTokens` array and the `lastRebalancerAllocations` and `lastAllocations` arrays may diverge after calling `setAllAvailableTokensAndWrappers()`. This is because the allocations are not adjusted or checked to be of the same length with the `protocolTokens` or `wrappers` input arrays of the `setAllAvailableTokensAndWrappers()` function. This means that the owner can effectively remove tokens from the `allAvailableTokens` array and the sum of all corresponding allocations would not be 100% by calling `setAllAvailableTokensAndWrappers()`.
Open the reportLowOwner can front-run flash loaners to change loan feeIdle Finance · Quantstamp · 23 Apr 2021Open
The owner of the `IdleTokenGovernance` contract has the privilege of front running any end-user who calls `flashLoan()` by calling `setFlashLoanFee()` and increasing the flash loan fee. Coupled with the fact that the `flashLoanFee` can be set up to 100% inside the `setFlashLoanFee()` function, this could be detrimental to the caller if sufficient funds are available in the caller's balance.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="idle-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us