Level security record
As of 3 Nov 2026, Level has 1 audit report on Trustblock, by Quantstamp, dated 29 Mar 2023. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Level Finance | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings32
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 4 |
| Medium | 2 | 1 | 2 |
| Low | 0 | 14 | 8 |
HighTechnical Documentation and Tests Are Severely LackingLevel Finance · Quantstamp · 29 Mar 2023Open
The protocol is overall underdocumented and underspecified. With a codebase so large and interconnected, there is a distinct need for documentation that can explain the purpose of each contract and how they fit together. Moreover, there is no technical specification to describe how the system should work as a whole. In the absence of such documentation, client-authored test suites are often used in order to arrive at something resembling a list of functional requirements. However, given the almost-entire absence of tests for the two audited repositories, this was not possible during the audit. In light of the above, communication with the client was pursued extensively in order to clarify design decisions and intended behaviour. However, this level of communication rarely suffices to alleviate problems caused by a lack of documentation. As a result, the audit was significantly impaired. Furthermore, the lack of tests increases operational risk for Level Finance, especially given the layered contract calls and interactions. Proper configuration is key for ensuring intended functionality, and yet there are no post-deployment checks.
Open the reportMediumNo Limit on Position Size with Current Timelock Configuration Enables Unstoppable Theft of Funds From PoolLevel Finance · Quantstamp · 29 Mar 2023Open
In LEV-9, we detailed that all LP funds can be locked in the pool for a period of time because of traders who open positions of sufficiently large size. In LEV-8, we detailed that the `Timelock` contract has only a 12-hour delay and has the ability to upgrade the `Pool` contract, allowing for funds to be stolen by the Level Finance team. Together, these issues form the basis for an attack that would allow the Level Finance team to lock all the LP funds and drain them through a coordinated contract upgrade.
Open the reportMediumPool Upgrade Can Enable Unexpected Loss or Theft of FundsLevel Finance · Quantstamp · 29 Mar 2023Open
After a 12 hour delay, the timelock can change the `ProxyAdmin`'s owner to a different address, allowing indiscriminate upgrading of the Pool. It is possible for such an upgrade to result in the loss of all the funds in the Pool, or to otherwise enrich the Timelock admin to the exclusion of the LPs. 12 hours is insufficient time to react to the queuing of an upgrade transaction.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="level-1"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us