Idle Finance security record
As of 30 Oct 2026, Idle Finance has 3 audit reports by 2 security firms on Trustblock; the latest is by Consensys, dated 1 Jun 2021. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Idle Finance | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Idle Finance | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Idle Governance | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings56
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 4 | 0 | 4 |
| Low | 8 | 16 | 24 |
LowAllowance Double-Spend ExploitIdle Finance · Quantstamp · 23 Apr 2021Acknowledged
As it presently is constructed, the contract is vulnerable to the [allowance double-spend exploit](https://github.com/OpenZeppelin/openzeppelin-solidity/blob/b4f87bb8fc25fb07f73099701e39e167a3d36465/contracts/token/ERC20/ERC20.sol#L71-L78), as with other ERC20 tokens.
Open the reportLowFlashloan could be used as a tool to manipulate liquidities of the underlying lending protocolsIdle Finance · Quantstamp · 23 Apr 2021Acknowledged
The `flashLoan` can be used to force triggering the rebalance process and moving funds in and out different underlying protocols. A related security issue is described in [EIP-3156](https://eips.ethereum.org/EIPS/eip-3156#flash-minting-external-security-considerations).
Open the reportLowFlashloans may decrease funds if underlying protocols have redemption feesIdle Finance · Quantstamp · 23 Apr 2021Acknowledged
The function `flashLoan` can be used to force triggering the rebalance process and move funds in and out different underlying protocols. If any of the underlying lending protocols have a redemption fee, an attacker who seeks to damage IdleFinance can achieve this by rapidly performing large value flashloans that cause IdleFinance to redeem and mint the underlying protocol’s tokens and end up losing money.
Open the reportLowIncorrect hardcoded addressesIdle Finance · Quantstamp · 23 Apr 2021Acknowledged
1. The address of the Idle governance token is hardcoded to `0x0001` on L85. 2. The address of the `oracle` is hardcoded to `0x0001` on L111. 3. The address of the `idleController` is hardcoded to `0x0001` on L112. 4. The following address seems to be an EOA, not a smart contract L131: `rebalancer = address(0xB3C8e5534F0063545CBbb7Ce86854Bf42dB8872B);` 5. The address of the `iToken` is hardcoded to `address(0)` on L130 and there is no setter function to change the `iToken` address.
Open the reportLowInitialization can be done multiple timesIdle Finance · Quantstamp · 23 Apr 2021Acknowledged
The owner of the `IdleTokenV3_1.sol` could call `manualInitialize` multiple times. This would reset several state variables. The semantics of the function name gives the impression that it should only be called once.
Open the reportLowMissing address sanitizationIdle Finance · Quantstamp · 23 Apr 2021Acknowledged
The values inside the `_newGovTokens` array input parameter are not checked to be different from `0x0` inside the `setGovTokens` function.
Open the reportLowMissing input checkIdle Finance · Quantstamp · 23 Apr 2021Acknowledged
1. The `manualInitialize` function does not check if the length of the 2nd, 3rd and 4th input arrays is the same. The `for`-loop inside this function assumes the length of `_protocolTokens`, `_wrappers` and `_lastRebalancerAllocations` input arrays is the same. 2. A comment on L105 indicates that the `_newGovTokens` array "should include IDLE". However, this is not verified inside the function. It could be verified by setting a binary flag to true inside the `if`-statement on `L124: if (newGov == IDLE) { continue; }`, and then checking this flag after the `for`-loop using a `require` statement.
Open the reportLowMissing return valueIdle Finance · Quantstamp · 23 Apr 2021Acknowledged
The `getGovApr` function does not have an explicit return value for the cases where the `if`-statement is not entered, i.e. the `if`-condition is not `true`.
Open the reportLowPrivileged rolesIdle Finance · Quantstamp · 23 Apr 2021Acknowledged
The owner of the `IdleTokenV3_1` contract has the right to change the following state variables at any time, they can even front-run end-users: 1. `setAllAvailableTokensAndWrappers` can be set to any address including EOAs 2. `setGovTokens` can be set to any address including EOAs 3. `setRebalancer` can be set to any address including an EOA 4. `setFee` upper bounded by 10% 5. `setMaxUnlentPerc` upper bounded to 100% 6. `setFeeAddress` can be set to any address including an EOA 7. `setOracleAddress` can be set to any address including an EOA 8. `setIdleControllerAddress` can be set to any address including an EOA 9. `setIsRiskAdjusted` 10. `setAllocations` this can also be done by the `rebalancer` address
Open the reportLowPrivileged Roles and OwnershipIdle Finance · Quantstamp · 23 Apr 2021Acknowledged
Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. Within `IdleRebalancerV3_1`, the owner can perform the following actions: 1. Can set the idle token exactly once via `setIdleToken` 1. Can set the rebalance manager address any number of times via `setRebalanceManager` 1. Can add any number of new tokens via `setNewToken` 1. Another role enforced by `onlyRebalancerAndIdle` modifier, which allows the rebalance manager or idle token to set completely new token allocations, for exactly the same token addresses, that sum up to 100% (any number of times). The `IdleTokenV3_1.sol` contract contains the following privileged actions: 1. Modify the `allAvailableTokens` array any number of times 1. Set the address of the `iToken` any number of times 1. Set the governance token address `govTokens` any number of times 1. Set the rebalancer address any number of times 1. Set the fee taken from end users any number of times to any value lower or equal to 10% 1. Set the maximum unlent asset percentage to any value lower than 100% 1. Set the fee address any number of times.
Open the reportShow 6 more
LowSecurity of Idle contracts is dependent on underlying lending protocolsIdle Finance · Quantstamp · 23 Apr 2021Acknowledged
Although there is no immediate exploit known at this time, since protocol wrappers can be added arbitrarily in the future, this issue could occur, and further unforeseen issues could arise in the existing underlying protocols.
Open the reportLowUnchecked function argumentsIdle Finance · Quantstamp · 23 Apr 2021Acknowledged
The function `_init` should ensure that `_tokenHelper` is non-zero.
Open the reportLowUninitialized inherited contracts and state variablesIdle Finance · Quantstamp · 23 Apr 2021Acknowledged
The `initialize` method has been replaced with the `manualInitialize` method, which is significantly different: 1. There are several inherited contracts which were initialized in the `initialize`, but are not initialized in the `manualyInitialize` method. The following code snippet indicates the initialization of these contracts, which was removed: ``` // Initialize inherited contracts ERC20Detailed.initialize(_name, _symbol, 18); Ownable.initialize(msg.sender); Pausable.initialize(msg.sender); ReentrancyGuard.initialize(); GST2ConsumerV2.initialize(); ``` 2. Similarly, the following state variables: `token`, `tokenDecimals`, `cToken` and `maxUnlentPerc`, were initialized in the `initialize` method, but are not initialized in the `manualyInitialize` method.
Open the reportLowUninitialized state variablesIdle Finance · Quantstamp · 23 Apr 2021Acknowledged
Several important state variables: `token`, `tokenDecimals`, and `isRiskAdjusted`, are not initialized anywhere.
Open the reportLowGas Usage / `for` Loop ConcernsIdle Governance · Quantstamp · 26 Oct 2020Acknowledged
Gas usage is a main concern for smart contract developers and users, since high gas costs may prevent users from wanting to use the smart contract. Even worse, some gas usage issues may prevent the contract from providing services entirely. For example, if a `for` loop requires too much gas to exit, then it may prevent the contract from functioning correctly entirely. It is best to break such loops into individual functions as possible. In particular, for `contracts/IdleController.sol`, if many markets are added, `refreshIdleSpeedsInternal()` may run into issues. **update-2020-10-26**: Idle Team added a `_resetMarkets` method which should completely remove all markets in case of emergency. Gas analysis was also conducted successfully.
Open the reportLowPrivileged RolesIdle Governance · Quantstamp · 26 Oct 2020Acknowledged
(a) For `contracts\PriceOracle.sol`, a potentially malicious owner (if the private key was leaked) can change the feed contract addresses/block length to give incorrect price oracles that can affect the token. While privileged roles for the Idle token are addressed in https://developers.idle.finance/advanced/admin-powers, it is not addressed for the price oracle. (b) For `contracts/IdleController.sol`, the admin can manipulate the rate of tokens in which each market receives by adding/removing idle markets to the list. **update-2020-10-26**: Idle Team stated that the owner of the `PriceOracle.sol` and the `IdleController.sol` contracts will be the Timelock contract (i.e., the governance itself) directly on deploy.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="idle-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us