As of 3 Nov 2026, LIQ Finance has 1 audit report on Trustblock, by CertiK, dated 1 Dec 2022. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| LIQ Finance | Security firm: CertiK | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · skynet.certik.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 1 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 0 | 4 |
The `LCakeVaultFactory.sol` mint NFTs as the certificate of deposits. But the function `burn()` in the aforementioned line can be called by anyone as it has no access restriction. This enables anyone to call this function to burn users' certificates. ```solidity=37 function burn(uint256 tokenId) public { _burn(tokenId); } ``` **Attack scenario**\ An attacker can call this function to burn all NFT certificates, thus causing the user to lose all funds in the contract `LCakeVaultImpl`.
Open the reportFor upgradeable contracts, there must be storage gap to "allow developers to freely add new state variables in the future without compromising the storage compatibility with existing deployments". Otherwise it may be very difficult to write new implementation code. Without storage gap, the variable in **child contract** might be overwritten by the upgraded base contract if new variables are added to the base contract. Refer to https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable
Open the reportThe **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller. ```solidity=23 modifier whenNotPaused { require(paused == false); _; } ```
Open the reportThe function doesn't verify if the supplied `baseURI` is a valid IPFS location.
Open the reportIt's recommended the team verify the UUPS implementation contract is initialized correctly. Besides initializing the contract, another way to prevent the implementation contract from being used is to invoke the "initializer" modifier in the constructor to automatically initialize it when it is deployed. For more information, please refer to: https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable#initializing_the_implementation_contract
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="liq-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us