As of 23 Oct 2026, Levva Protocol has 2 audit reports by 1 security firm on Trustblock; the latest is by Quantstamp, dated 25 Apr 2024. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Levva Updates and Oracle Feature | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Levva Protocol | Security firm: Quantstamp | Date: | Scope: Repository at commit d82fefd | No open critical findings | Open · certificate.quantstamp.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 6 |
| Medium | 0 | 0 | 6 |
| Low | 1 | 9 | 12 |
It is important to always round in the protocol's favor to not accrue bad debt. Below we outline minor instances of rounding. Given the `X96` notation, these rounding errors are extremely minor, yet we would still like to point them out. * In `withdrawBase()`, `discountedBaseCollateralDelta` should be rounded up explicitly. Conversely, in `withdrawQuote()`, `discountedQuoteCollateralDelta` should be rounded up explicitly. * In `closePosition()`, `discountedCollateralDelta` should be explicitly rounded up, both in the long and short position case. * In `short()`, `discountedBaseDebtChange` should be explicitly rounded up. Conversely, in `long()`, `discountedQuoteDebtChange` should be explicitly rounded up. * In `depositBase()`, `realBaseDebt`, `discountedQuoteCollDelta`, and the calculation performed in the conditional statement in L476 should be rounded up explicitly. The result of the `mul()`operation for `discountedQuoteCollDelta` at L495 should be rounded up explicitly too. * In `depositQuote()`, `realQuoteDebt` and `discountedBaseCollDelta ` should be rounded up explicitly. * In `liquidate()`, `positionBaseDebt`, `quoteCollToReduce`, `positionQuoteDebt`, and `baseCollToReduce` should be rounded up explicitly. When liquidating a short-position, `disQuoteDelta` should be explicitly rounded up. When liquidating long-positions, `disBaseDelta` should be explicitly rounded up. * In `enactMarginCall()`, the multiplication performed for `realBaseDebt` and `realQuoteDebt` should be rounded up explicitly. * In `sellBaseForQuote()`, the multiplication performed for `realQuoteDebt` should be rounded up. Conversely, in `sellQuoteForBase()`, `realBaseDebt` should be rounded up explicitly. * In `accrueInterest()`, the multiplications performed for `realBaseDebtPrev` and `realQuoteDebtPrev` should be rounded up explicitly. * In `calcRealBaseCollateral()`, the result of `baseDelevCoeff.mul(disQuoteDebt)` should be rounded up explicitly. Conversely, in `calcRealQuoteCollateral()`, the result of `quoteDelevCoeff.mul(disBaseDebt)` should be rounded up explicitly. * In `positionHasBadLeverage()`, all multiplications performed between `FP96.FixedPoint` and `uint256` for `realTotalDebt` should be rounded up explicitly. * In `updateHeap()` in the short case, `initialPrice.mul(position.discountedBaseAmount)` should be round up explicitly. * In `receivePosition()`, the multiplications performed for `badPositionBaseDebt` and `badPositionQuoteDebt` should be rounded up explicitly. * In `shutDown()`, the result of `basePrice.mul(baseDebt)` in L1271 should be rounded up explicitly. * In `setEmergencyMode()`, the result of `shutDownPrice.mul(emergencyDebt)` should be rounded up explicitly. * In `emergencyWithdraw()`, the multiplications performed for `positionBaseNet` and `positionQuoteNet` should be rounded up explicitly. * In `updateSystemLeverageLong()`, `realQuoteDebt` should be rounded up. Conversely, in `updateSystemLeverageShort()` both multiplications performed for `realBaseDebt` should be rounded up explicitly. In both functions, `leverageX96` should be rounded up explicitly.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="levva-protocol"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us