As of 3 Nov 2026, Linkswap has 1 audit report on Trustblock, by Quantstamp, dated 3 Nov 2020. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Linkswap | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 3 | 6 |
The function `burn` has no access restriction. Anyone can use this function to burn all the balance holds by this contract.
Open the reportOn L165: `require(support != (proposal.forVotes[msg.sender] > 0), "yYFL: SAME_VOTE");`, the conditional may incorrectly report a "same vote" when the vote has changed. Consider the following scenario: 1. A user has 10 YFL tokens that they use to vote for Proposal A, locking all 10 tokens; 2. The user gains 10 more tokens, and votes on Proposal B with all 20 tokens, also increasing their lock to 20. 3. The user wishes to increase their vote to 20 tokens for Proposal A. Both checks on L164-165 will succeed, triggering the revert.
Open the reportThe function is `external`, however all tokens transferred to this contract and then used to purchase YFL are sent to the governance contract, not the original `msg.sender`.
Open the reportThe function `getFirstObservationInWindow` returns the observation from the oldest epoch, which is set when `update` is invoked earlier in the `window`. However, if for any reason an epoch is missed by the oracle (e.g., via server outages, congested network, etc.), the epoch will continue to have stale data. If `consult` is invoked when this stale data is returned by `getFirstObservationInWindow`, the function will revert for the entire current epoch. Note that this effects upstream functions including `calculateTokenAmountFromUsdAmount`.
Open the reportThe function accepts a list of tokens, however conversions are only made between the pairs `(LINK, WETH)` and `(WETH, YFL)` Any other tokens are simply sent back to the governance address. Since the function is not documented, it is unclear what the intended semantics should be.
Open the reportEvery Solidity file specifies in the header a version number of the format `pragma solidity (^)0.4.*`. The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked".
Open the reportAn attacker can execute arbitrary code by providing a fake token address to the function `purchaseYfl`.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="linkswap"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us