LIF3 security record
As of 3 Nov 2026, LIF3 has 3 audit reports by 2 security firms on Trustblock; the latest is by CertiK, dated 27 Feb 2024. Those reports list 1 critical acknowledged and not fixed. It also holds 1 deployed contract on 1 chain.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Lif3 L3USD | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | 1 critical acknowledged, not fixed | Open · skynet.certik.com |
| Lif3 - vaults - SC | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Lif3 / ERC20 | Security firm: Hacken | Date: | Scope: 1 address on Fantom | No open critical findings | Open · hacken.io |
Findings15
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 0 |
| High | 0 | 2 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 6 | 0 | 5 |
CriticalCentralization Related RisksLif3 L3USD · CertiK · 27 Feb 2024Acknowledged
In the contract `L3USD`, the role `minter` has authority over function `issue()`. Any compromise to any of the `minter` accounts may allow a hacker to take advantage of this authority and mint any amount of token to their wallet. In the contract `L3USD`, the role `owner` has authority over the following functions via these (abstract) contracts: - `transferOwnership()` - `pause()` - `unpause()` - `addBlackList()` - `removeBlackList()` - `destroyBlackFunds()` - `deprecate()` - `redeem()` - `addMinter()` - `removeMinter()` - `setParams()` Any compromise to the `owner` account may allow a hacker to take advantage of this authority and deprecate this contract, arbitrarily set minters, set fee rate and max fee, collect fees, disrupt normal token activities, and even remove all the token balance in any token holder.
Open the reportHighCentralization Risks in LockingRewardPool.solLif3 - vaults - SC · CertiK · 9 Feb 2023Acknowledged
In the contract `LockingRewardPool` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below, as well as the privilege to assign/revoke all roles. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and arbitrarily set the lower limit of deposit amount, and assign/revoke privileged roles.  In the contract `LockingRewardPool` the role `RECOVERER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `RECOVERER_ROLE` account may allow the hacker to take advantage of this authority and withdraw any token that's not involved in the lock and reward process.  In the contract `LockingRewardPool` the role `REWARD_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `REWARD_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and add and update the reward tokens and related reward rate. Notice that changing the reward token decimal will result in the reset of current reward distribution.  In the contract `LockingRewardPool` the role `TAX_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `TAX_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and arbitrarily set the fee rates and fee exemption. 
Open the reportHighCentralization Risks in LockNFT.solLif3 - vaults - SC · CertiK · 9 Feb 2023Acknowledged
In the contract `LockNFT` the role `CREATOR_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `CREATOR_ROLE` account may allow the hacker to take advantage of this authority and arbitrarily mint lock NFT.  In the contract `LockNFT` the role `DESTROYER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DESTROYER_ROLE` account may allow the hacker to take advantage of this authority and arbitrarily burn lock NFT.  In addition, the role `DEFAULT_ADMIN_ROLE` has the authority to grant and renounce the `CREATOR_ROLE` and `DESTROYER_ROLE` roles, as provided by the inherited contract `AccessControl`. Any compromise to the `DESTROYER_ROLE` account may allow the hacker to take advantage of this authority and take over privileged role's management.
Open the reportContracts1
| Address | Chain |
|---|---|
| 0xbf60e7414ef09026733c1e7de72e7393888c64da | Chain: Fantom |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="lif3"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us