ListaDAO security record
As of 9 Nov 2026, ListaDAO has 13 audit reports by 3 security firms on Trustblock; the latest is by BlockSec, dated 1 Dec 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits13
Newest first
| Report | Security firm | Date | Scope | Critical findings | Source |
|---|---|---|---|---|---|
| Lista Lending audit | Security firm: BlockSec | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| SpearBit V3 LP 01Sept 2025 security review | Security firm: Cantina | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Lista Dao Contracts audit | Security firm: BlockSec | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Lista Lending Provider audit | Security firm: BlockSec | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Blocksec Lista LPTokenProvider V1.0 Signed | Security firm: BlockSec | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Lista Lending audit | Security firm: BlockSec | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Blocksec Lista SlisbnbProvider VotingIncentive V1. | Security firm: BlockSec | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| PSM audit | Security firm: BlockSec | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Lista Token audit | Security firm: BlockSec | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Lista Dao Contracts audit | Security firm: BlockSec | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Lista Dao Contracts audit | Security firm: BlockSec | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| ListaOFT audit | Security firm: BlockSec | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Lista: Lista Oracles audit | Security firm: PeckShield | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
Findings99
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed | Mitigated |
|---|---|---|---|---|
| Critical | 0 | 0 | 0 | 0 |
| High | 0 | 0 | 14 | 0 |
| Medium | 0 | 7 | 13 | 0 |
| Low | 0 | 22 | 42 | 1 |
HighBypass of nonReentrant in provide via Direct PCS V3 Position NFT TransferSpearBit V3 LP 01Sept 2025 security review · Cantina · 17 Sep 2025Fixed
The report gives no description here.
Open the reportHighgetLpValue misapplies decimal scaling for tokens with decimals other than 18SpearBit V3 LP 01Sept 2025 security review · Cantina · 17 Sep 2025Fixed
The report gives no description here.
Open the reportHighWithdrawals and harvests fail when MasterChefV3 has insufficient CAKESpearBit V3 LP 01Sept 2025 security review · Cantina · 17 Sep 2025Fixed
The report gives no description here.
Open the reportHighFee drainage due to insufficient validation of providers Security IssueLista Dao Contracts audit · BlockSec · 3 Sep 2025Fixed
The report gives no description here.
Open the reportHighIncorrect calculation in the function _getMaxCdpWithdrawable() Security IssueLista Dao Contracts audit · BlockSec · 3 Sep 2025Fixed
The report gives no description here.
Open the reportHighIncorrect sqrtPriceX96 calculation due to unhandled token decimal differences Security IssueLista Dao Contracts audit · BlockSec · 3 Sep 2025Fixed
The report gives no description here.
Open the reportHighLack of decimal conversion leads to incorrect liquidation calculations Security IssueLista Dao Contracts audit · BlockSec · 3 Sep 2025Fixed
The report gives no description here.
Open the reportHighReward tokens are not sent to the recipient on liquidity decrease Security IssueLista Dao Contracts audit · BlockSec · 3 Sep 2025Fixed
The report gives no description here.
Open the reportHighIncorrect position synchronization in the withdrawCollateral() functionLista Lending Provider audit · BlockSec · 12 May 2025Fixed
The report gives no description here.
Open the reportHighLoss of funds due to the incorrect use of the input assetsLista Lending Provider audit · BlockSec · 12 May 2025Fixed
The report gives no description here.
Open the reportShow 10 more
HighPotentially immutable userLpRate due to the unset variable exchangeRateLista Lending Provider audit · BlockSec · 12 May 2025Fixed
The report gives no description here.
Open the reportHighFailed transferFrom() due to contract’s lack of approval for ownerLista Dao Contracts audit · BlockSec · 14 Aug 2024Fixed
The report gives no description here.
Open the reportHighPotential DoS due to improper approve amountLista Dao Contracts audit · BlockSec · 14 Aug 2024Fixed
The report gives no description here.
Open the reportHighSandwich attacks caused by incorrect calculation of minOutLista Dao Contracts audit · BlockSec · 14 Aug 2024Fixed
The report gives no description here.
Open the reportMediumModule disablement halts liquidation and collateral withdrawal Security IssueLista Lending audit · BlockSec · 1 Dec 2025Fixed
The report gives no description here.
Open the reportMediumLP NFTs deposited during emergency mode cannot earn rewards after normal operations resumeSpearBit V3 LP 01Sept 2025 security review · Cantina · 17 Sep 2025Fixed
The report gives no description here.
Open the reportMediumRewards are incorrectly calculated when one of the token0 and token1 is the rewardToken Security IssueLista Dao Contracts audit · BlockSec · 3 Sep 2025Fixed
The report gives no description here.
Open the reportMediumFailure of supplying WBNB as collateralLista Lending Provider audit · BlockSec · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumIncorrect calculation of the wrapAmount variableLista Lending Provider audit · BlockSec · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumLack of checks on the variable _userLpRate in the function initialize()Lista Lending Provider audit · BlockSec · 12 May 2025Fixed
The report gives no description here.
Open the reportShow 10 more
MediumThe delegatee can be maliciously resetLista Lending Provider audit · BlockSec · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumUsers can obtain LP tokens without supplying collateralLista Lending Provider audit · BlockSec · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumIncorrect LP token mint addressBlocksec Lista LPTokenProvider V1.0 Signed · BlockSec · 3 Apr 2025Fixed
The report gives no description here.
Open the reportMediumPotential inflation attacksLista Lending audit · BlockSec · 3 Apr 2025Fixed
The report gives no description here.
Open the reportMediumFailure of reward claim due to incorrect check in function batchClaim()Blocksec Lista SlisbnbProvider VotingIncentive V1. · BlockSec · 26 Nov 2024Fixed
The report gives no description here.
Open the reportMediumPotential DoS in withdrawal process due to improper checks in function setAdapter()PSM audit · BlockSec · 22 Nov 2024Fixed
The report gives no description here.
Open the reportMediumLack of duty range check in function calculateDuty()Lista Dao Contracts audit · BlockSec · 6 Aug 2024Fixed
The report gives no description here.
Open the reportLowAdd zero value check in wallet configurationLista Lending audit · BlockSec · 1 Dec 2025Fixed
The report gives no description here.
Open the reportLowRedundant codeLista Lending audit · BlockSec · 1 Dec 2025Fixed
The report gives no description here.
Open the reportLowInconsistent ownership validation for direct ERC721 transfersSpearBit V3 LP 01Sept 2025 security review · Cantina · 17 Sep 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowMinor improvements to code and commentsSpearBit V3 LP 01Sept 2025 security review · Cantina · 17 Sep 2025Fixed
The report gives no description here.
Open the reportLowMissing max feeRate checkSpearBit V3 LP 01Sept 2025 security review · Cantina · 17 Sep 2025Fixed
The report gives no description here.
Open the reportLowMissing token validationSpearBit V3 LP 01Sept 2025 security review · Cantina · 17 Sep 2025Fixed
The report gives no description here.
Open the reportLowOverly complicated rewards calculation function can be simplifiedSpearBit V3 LP 01Sept 2025 security review · Cantina · 17 Sep 2025Fixed
The report gives no description here.
Open the reportLowWrong rounding direction causes protocol fees to be underestimatedSpearBit V3 LP 01Sept 2025 security review · Cantina · 17 Sep 2025Fixed
The report gives no description here.
Open the reportLowDiscrepancy between LP Token Value and LpUsd may cause auctions to fail to conclude Security IssueLista Dao Contracts audit · BlockSec · 3 Sep 2025Fixed
The report gives no description here.
Open the reportLowInteraction to MasterChefV3 still enabled in emergency mode Security IssueLista Dao Contracts audit · BlockSec · 3 Sep 2025Fixed
The report gives no description here.
Open the reportLowLack of handling positions’ rewards in emergency mode Security IssueLista Dao Contracts audit · BlockSec · 3 Sep 2025Fixed
The report gives no description here.
Open the reportLowPotential circumvention of the pause mechanism Security IssueLista Dao Contracts audit · BlockSec · 3 Sep 2025Fixed
The report gives no description here.
Open the reportLowPotential DoS during emergency operations Security IssueLista Dao Contracts audit · BlockSec · 3 Sep 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowProviders did not burn ceToken and LpUsd in the function liquidation() Security IssueLista Dao Contracts audit · BlockSec · 3 Sep 2025Fixed
The report gives no description here.
Open the reportLowUser liquidation record may never be deleted Security IssueLista Dao Contracts audit · BlockSec · 3 Sep 2025Fixed
The report gives no description here.
Open the reportLowAdd state change checks in the setUserLpRare() functionLista Lending Provider audit · BlockSec · 12 May 2025Fixed
The report gives no description here.
Open the reportLowLack of checks on the variable wrapAmount in the repay() functionLista Lending Provider audit · BlockSec · 12 May 2025Fixed
The report gives no description here.
Open the reportLowLack of invoking function _disableInitializers()Lista Lending Provider audit · BlockSec · 12 May 2025Fixed
The report gives no description here.
Open the reportLowLack of zero address checksLista Lending Provider audit · BlockSec · 12 May 2025Fixed
The report gives no description here.
Open the reportLowUnify the the use of the variable RATE_DENOMINATORLista Lending Provider audit · BlockSec · 12 May 2025Fixed
The report gives no description here.
Open the reportLowBypass of the bad debt handling mechanism in the liquidate() functionLista Lending audit · BlockSec · 3 Apr 2025Fixed
The report gives no description here.
Open the reportLowInconsistent validation logic in exchange rate and user LP rate settingsBlocksec Lista LPTokenProvider V1.0 Signed · BlockSec · 3 Apr 2025Fixed
The report gives no description here.
Open the reportLowLack of check in function initialize()Blocksec Lista LPTokenProvider V1.0 Signed · BlockSec · 3 Apr 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowLack of validation checks in the createMarket() functionLista Lending audit · BlockSec · 3 Apr 2025Fixed
The report gives no description here.
Open the reportLowInconsistent check of system variable configurationBlocksec Lista SlisbnbProvider VotingIncentive V1. · BlockSec · 26 Nov 2024Fixed
The report gives no description here.
Open the reportLowLack of check in function provide()Blocksec Lista SlisbnbProvider VotingIncentive V1. · BlockSec · 26 Nov 2024Fixed
The report gives no description here.
Open the reportLowLack of check to ensure the address is not zeroBlocksec Lista SlisbnbProvider VotingIncentive V1. · BlockSec · 26 Nov 2024Fixed
The report gives no description here.
Open the reportLowLack of check when updating adminVoterBlocksec Lista SlisbnbProvider VotingIncentive V1. · BlockSec · 26 Nov 2024Fixed
The report gives no description here.
Open the reportLowLack of proper check for querying claimable amountBlocksec Lista SlisbnbProvider VotingIncentive V1. · BlockSec · 26 Nov 2024Fixed
The report gives no description here.
Open the reportLowLack of check in function removePSM()PSM audit · BlockSec · 22 Nov 2024Fixed
The report gives no description here.
Open the reportLowIncorrect comment in function _vote()Lista Token audit · BlockSec · 16 Oct 2024Fixed
The report gives no description here.
Open the reportLowLack of check on _adminVotePeriod in function initialize()Lista Token audit · BlockSec · 16 Oct 2024Fixed
The report gives no description here.
Open the reportLowComment mismatch with code logicLista Dao Contracts audit · BlockSec · 6 Aug 2024Fixed
The report gives no description here.
Open the reportShow 9 more
LowIncorrect price used in function borrow()Lista Dao Contracts audit · BlockSec · 6 Aug 2024Fixed
The report gives no description here.
Open the reportLowLack of rate update in function withdraw()Lista Dao Contracts audit · BlockSec · 6 Aug 2024Fixed
The report gives no description here.
Open the reportLowRedundant check in function setCollateralParms()Lista Dao Contracts audit · BlockSec · 6 Aug 2024Fixed
The report gives no description here.
Open the reportLowTimely update role in function file()Lista Dao Contracts audit · BlockSec · 6 Aug 2024Fixed
The report gives no description here.
Open the reportLowIncorrect check in function _setTransfer- LimitConfig()ListaOFT audit · BlockSec · 19 Jun 2024Fixed
The report gives no description here.
Open the reportLowIncorrect check of time difference in is- MoreThanACalendarDay()ListaOFT audit · BlockSec · 19 Jun 2024Fixed
The report gives no description here.
Open the reportLowLack of dust removal in function _checkAndUpdateTransferLimit()ListaOFT audit · BlockSec · 19 Jun 2024Fixed
The report gives no description here.
Open the reportLowImproved Constructor/Initialization Logic in ResilientOracle/BoundVal- idatorLista: Lista Oracles audit · PeckShield · 30 Apr 2024Fixed
The report gives no description here.
Open the reportLowImproved getPriceFromOracle() Logic in ResilientOracle Coding PracticeLista: Lista Oracles audit · PeckShield · 30 Apr 2024Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="lisusd"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us