As of 3 Nov 2026, LiteDex has 1 audit report on Trustblock, by CertiK, dated 24 Jan 2023. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Litedex audit 3 | Security firm: CertiK | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · skynet.certik.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 1 | 0 | 3 |
| Medium | 0 | 0 | 0 |
| Low | 1 | 0 | 10 |
When `msg.sender` calls `enterStaking()` , `sldx` token will be minted to `msg.sender` when `pool.lpToken` is staked in the contract. However, if the `msg.sender` calls `emergencyWithdraw()`, the `pool.lpToken` can be transferred back to the `msg.sender` but the `sldx` token that has been minted to the `msg.sender` will not be burnt. Therefore, `msg.sender` can call `enterStaking()` and `emergencyWithdraw()` repeatedly to ultimately mint a huge amount of sldx token, with just the same amount of pool.lpToken
Open the reportThe function `mint()` and `burn()` lacks of access control which makes anyone can mint/burn tokens to/from any account
Open the reportThe comment in line L1575, mentioned * DO NOT add the same LP token more than once. Rewards will be messed up if you do. Rewards will be messed up if you do. The total amount of reward in function `updatePool()` will be incorrectly calculated if the same LP token is added into the pool more than once in function `add()`. However, the code does not reflect as the comment behaviors as there isn’t any valid restriction on preventing this issue. The current implementation is relying on the trust of the owner to avoid repeatedly adding same LP token to the pool, as the function will only be called by the owner.
Open the reportWhenever new tokens are minted, new delegates are moved from the zero address to the recipient of the minting process. However, whenever tokens are burned, new delegates are once again moved from the zero address to the recipient whereas delegates should be moved on the opposite way.
Open the reportIn the contract `LitedexFarmer.sol`, the function `LitedexSP.safeLdxTransfer(address,uint256)` calls function `ldx.transfer(_to,ldxBalance)`. According to definition of `ldx.transfer(_to,ldxBalance)` in L744, there should be a boolean return value. However, the return value of `ldx.transfer(_to,ldxBalance)` is not checked in the function call `LitedexSP.safeLdxTransfer(address,uint256)`. Similar issue is in the following functions: LitedexFarmer.sol: * `LitedexSP.safeLdxTransfer(address,uint256)` ignores return value by `ldx.transfer(_to,ldxBalance)` LitedexStakePool.sol: * `LitedexSP.safeMacaronTransfer(address,uint256)` ignores return value by `ldx.transfer(_to,ldxBal)` * `LitedexSP.safeMacaronTransfer(address,uint256)` ignores return value by `ldx.transfer(_to,_amount)`
Open the report`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.
Open the reportThere is no validation to check whether startBlock must be lower than endBlock and whether `_stakedToken` and `_rewardToken` are zero addresses.
Open the reportThere should always be events emitted in the sensitive functions that are controlled by centralization roles.
Open the reportThe **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.
Open the reportAddresses should be checked before assigning to make sure they are not zero addresses.
Open the reportA reentrancy issue can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.
Open the reportThere's no sanity check to validate if a pool is existing. The current implementation simply relies on the implicit, compiler-generated bound-checks of arrays to ensure the pool index stays within the array range [0, poolInfo.length-1]. However, considering the importance of validating given pools and their numerous occasions, a better alternative is to make explicit the sanity checks by introducing a new modifier.
Open the reportThe contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.
Open the reportThe linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="litedex"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us