Illuvium security record
As of 21 Oct 2026, Illuvium has 6 audit reports by 4 security firms on Trustblock; the latest is by Cyfrin, dated 21 Oct 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits6
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Illuvium Staking V3 Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Illuvium Land Sale Protocol | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Illuvium audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Illuvium (Part 4 - Staking V2) | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Illuvium Yield Farming Rewards | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Illuvium ERC20 | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings60
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 2 |
| Medium | 2 | 0 | 5 |
| Low | 2 | 10 | 37 |
HighCentralization Related RisksIlluvium Land Sale Protocol · CertiK · 18 May 2022Acknowledged
In the contract `LandSale.sol`, the following roles has authority over the following functions: - `ROLE_DATA_MANAGER` role has authority over function `setInputDataRoot()` - `ROLE_SALE_MANAGER` role has authority over function `initialize()` - `ROLE_PAUSE_MANAGER` role has authority over function `pause()` - `ROLE_PAUSE_MANAGER` role has authority over function `resume()` - `ROLE_WITHDRAWAL_MANAGER` role has authority over function `setBeneficiary()` - `ROLE_WITHDRAWAL_MANAGER` role has authority over function `withdrawTo()` - `ROLE_RESCUE_MANAGER` role has authority over function `rescueErc20()` - Any compromise to the privileged roles may allow a hacker to take advantage of this authority and update the sensitive settings and execute sensitive functions of the project.
Open the reportHighMissing Validation of the Oracle’s OutputIlluvium (Part 4 - Staking V2) · Quantstamp · 17 Mar 2022Acknowledged
The function `_swapETHForILV(...)` swaps ETH for ILV tokens. However, the function does not validate the Oracle’s output. What if the price returned is zero? What if it is absurdly large? Moreover, SushiSwap works as an AMM (Automated Market Maker), which can be manipulated by big investors.
Open the reportLowReserve-weighted allocations use spot reservesIlluvium Staking V3 Audit Report · Cyfrin · 21 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowClone-and-OwnIlluvium (Part 4 - Staking V2) · Quantstamp · 17 Mar 2022Acknowledged
The clone-and-own approach involves copying and adjusting open source code at one's own discretion. From the development perspective, it is initially beneficial as it reduces the amount of effort. However, from the security perspective, it involves some risks as the code may not follow the best practices, may contain a security vulnerability, or may include intentionally or unintentionally modified upstream libraries.
Open the reportLowGas Usage / `for` Loop ConcernsIlluvium (Part 4 - Staking V2) · Quantstamp · 17 Mar 2022Acknowledged
Gas usage is a main concern for smart contract developers and users, since high gas costs may prevent users from wanting to use the smart contract. Even worse, some gas usage issues may prevent the contract from providing services entirely. For example, if a `for` loop requires too much gas to exit, then it may prevent the contract from functioning correctly entirely. It is best to break such loops into individual functions as possible. Any user can make an arbitrary number of stakes. However, this can lead for very large arrays of stakes, and such arrays need to be traversed, such as in function `CorePool.BalanceOf(...)`and `CorePool.getV1StakePosition(...)`(and other functions of the same file). The size of the pools must also be considered, since some functions have to loop over the pools, such as in function `ILVPool.claimYieldRewardsMultiple(...)`.
Open the reportLowPrivileged Roles and OwnershipIlluvium (Part 4 - Staking V2) · Quantstamp · 17 Mar 2022Acknowledged
Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. In this project, only the owner can set pools, convert ETH to ILP in `Vault.sol` and only the owner can perform upgrades in `PoolFactory.sol`.
Open the reportLow`blocksPerUpdate` Is Defined In Blocks But Is Expected To Be 2 WeeksIlluvium Yield Farming Rewards · Quantstamp · 14 Aug 2021Acknowledged
Several comments suggest that `blocksPerUpdate` should equal 2 weeks, but is defined in blocks which have variable mining times. It is not clear why `timestamp` is not used for this variable instead, particularly since block timestamp manipulation will have minimal effect for such a large timespan.
Open the reportLow`IlluviumFlashPool` Does Not Check If Lock Period Has PassedIlluvium Yield Farming Rewards · Quantstamp · 14 Aug 2021Acknowledged
The `IlluviumPoolBase._unstake` function (inherited by `IlluviumFlashPool`) does not check if `block.timestamp > lockedUntil` of a deposit. The `IlluviumCorePool` adds a check in its overridden function `_unstake`, however, `IlluviumFlashPool` does not override the `_unstake` function.
Open the reportLowClone-and-OwnIlluvium Yield Farming Rewards · Quantstamp · 14 Aug 2021Acknowledged
The clone-and-own approach involves copying and adjusting open source code at one's own discretion. From the development perspective, it is initially beneficial as it reduces the amount of effort. However, from the security perspective, it involves some risks as the code may not follow the best practices, may contain a security vulnerability, or may include intentionally or unintentionally modified upstream libraries. <br><br> All files in the `utils/` sub-directory are cloned from open source repositories such as openzeppelin.
Open the reportLowPrivileged Roles and OwnershipIlluvium Yield Farming Rewards · Quantstamp · 14 Aug 2021Acknowledged
Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. The following instances of this issue have been identified: 1. The `owner` of the `TokenLocking` contract can perform the following privileged actions: * Set the `pool` address for ILV staking (only once). * Set the balances of tokens owned by any address, e.g. pre-seed investors, seed investors, team members, etc. This can be done multiple times. 2. The `owner` of `IlluviumPoolFactory` can create/register unlimited pools at will.
Open the reportShow 2 more
LowPrivileged Roles and OwnershipIlluvium ERC20 · Quantstamp · 19 Mar 2021Acknowledged
Smart contracts will often have `owner` variables (or other privileged roles) to designate the person with special privileges to make modifications to the smart contract. The following privileged roles and capabilities exist in the system: 1. `ROLE_TOKEN_CREATOR` can mint arbitrary amounts of ILV to any account at any time. 2. `ROLE_TOKEN_DESTROYER` can burn arbitrary amount of ILV from any account at any time.
Open the reportLowUnsafe way to check if address is contract or EOAIlluvium ERC20 · Quantstamp · 19 Mar 2021Acknowledged
The way in which `safeTransfer()` checks whether the `_to` address is a contract or an EOA is not always safe, because it uses the `extcodesize` instruction, which returns 0 indicating an EOA, when it is called from the `constructor()` of the `_to` address. This would effectively allow transferring ILV to a contract which is not a valid `ERC20Receiver` via the `safeTransferFrom()` function.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="illuvium"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us