Kalao security record

Avalanchekalao.io

As of 3 Nov 2026, Kalao has 1 audit report on Trustblock, by Paladin, dated 5 Apr 2022. That report lists no open critical findings.

Critical findings
No open critical findings
In 1 report.
Open the latest report
Your label, live
Get the label for your site

Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.

Audits1

Newest first

AuditSecurity firmDateScopeCritical findingsReport
Audit Report: Kalao Builder

Audit

Security firm: PaladinDate: Scope: Not recorded (see the report)No open critical findingsOpen · paladinsec.co

Findings39

Statuses are the security firm’s own, from each report.

SeverityOpenAcknowledgedFixed
Critical000
High050
Medium030
Low0238
HighGovernance privilege: gov can withdraw all tokens through withdrawTokenAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
HighGovernance privilege: handler addresses are able to make crucial changes to the protocol and the user through handler-specific functionsAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
HighGovernance privilege: Handler addresses may stake, unstake and claim on behalf of userAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
HighGovernance privilege: Handler can transfer unlimited amount through transferFromAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
HighGovernance privilege: Owner can withdraw all tokens through withdrawTokenAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
MediumGovernance privilege: transfer, stake, and claim can be disabled by Gov through setInPrivateTransferMode, setInPrivateStakingMode and setInPrivateClaimingModeAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
MediumtransferStakeValues can be used multiple times to inflate the values of transferredAverageStakedAmounts, transferredCumulativeRewards, andAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
MediumWhen the admin changes the emission rate from zero to non-zero, rewards will be given retroactively over the whole period where no rewards were supposed to be givenAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
Low_deposit does not support fee-on-transfer tokensAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
Lowclaim can be used to redirect rewards to another addressAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
Show 10 more
LowConstructor lacks a zero address check in the rewardToken and rewardTracker inputAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowConstructor lacks a zero address check in the token address inputsAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowdepositForAccount forces a transfer from an _account into the vesting contract and not a helper function where governance can deposit tokens on behalf of a userAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowgetTotalVested computation is inconsistent as cumulativeClaimAmounts is going to reset whenever a call to withdraw() is madeAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowGovernance privilege: Owner can withdraw all tokens including the reward tokens through withdrawTokenAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowGovernance privilege: Owner can withdraw all tokens through withdrawTokenAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowLack of events for setAdmin, withdrawToken and updateLastDistributionTimeAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowLack of events for setGovAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowLack of events for several functionsAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowLack of events for several functionsAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
Show 10 more
LowLack of indexing for event parametersAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowLack of indexing for event parametersAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowLack of indexing for event parameters for Claim, Deposit and WithdrawAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowLack of validation: gov can be set to the zero addressAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowsetTokensPerInterval function lacks a maximum value check where excessive rewards may be distributedAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowTypographical errorsAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowTypographical errorsAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowTypographical errorsAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowTypographical errorsAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
LowVesting logic speeds up second deposits once the cumulativeClaimAmounts have been increased due to the previous deposit madeAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report
Show 1 more
Lowwithdraw, _deposit, _updateVesting are not written in the checks-effects-interactions patternAudit Report: Kalao Builder · Paladin · 5 Apr 2022Acknowledged

The report gives no description here.

Open the report

Contracts

No deployed address is recorded for these audits.

The reports name a repository or files. Open a report to see its scope.

Show this on your site

Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.

Content

Facts

Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.

Fixed as
Language

Style

Layout
Theme
Accent
Corners

Format

Size
Date
Embed as
HTML
<head>
	<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
</head>
<body>
	<div
		data-tb-project-widget
		data-tb-project-slug="kalao-builder"
	></div>
</body>

Paste the code where the label should appear. It uses no API credit and updates by itself.

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us