Lithium Finance security record
As of 3 Nov 2026, Lithium Finance has 1 audit report on Trustblock, by CertiK, dated 13 Dec 2022. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Lithium Finance Ⅳ | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings14
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 1 | 0 |
| Low | 0 | 7 | 5 |
HighCentralization Related RisksLithium Finance Ⅳ · CertiK · 13 Dec 2022Acknowledged
In the contract **EnquiryPool** the role **_owner** has authority over the functions shown in the diagram below. Any compromise to the **_owner** account may allow the hacker to take advantage of this authority.  In the contract **Reputation** the role **_owner** has authority over the functions shown in the diagram below. Any compromise to the **_owner** account may allow the hacker to take advantage of this authority. 
Open the reportMediumLogical issue in `updateAnswer`Lithium Finance Ⅳ · CertiK · 13 Dec 2022Acknowledged
The `RP_TOKEN` owned by the user decreases gradually on a daily basis over time, but calling `mint()` or `burn()` can continuously push the starting calculation time backward. Therefore, the user only needs to call `updateAnswer()` daily to trigger the call to `mint()` or `burn()`, which could avoid the RP_TOKEN reduction mechanism.
Open the reportLowFixed exchange rate of two tokensLithium Finance Ⅳ · CertiK · 13 Dec 2022Acknowledged
The exchange rate of `_stakeAmount` and `_stakeToken` is variable in the real market, which means that the fixed exchange rate of `enquiries[_enquiryId].BACrossRate` may allow users to stake the lower-priced token in the market in order to take advantage of it. This situation may not be intended and could potentially be addressed in future updates.
Open the reportLowThe financial modelLithium Finance Ⅳ · CertiK · 13 Dec 2022Acknowledged
The Lithium project uses a system of inquiries through the addition of rewards by price seekers and predictions and quotations by price experts to measure the value of NFTs, realizing a price oracle for NFTs. However, many logic implementations are not within the scope of this audit, such as the generation of correct prices, the specific allocation of rewards, and the mechanism for obtaining RP_Tokens. It is recommended for the client recheck whether the logic is correct.
Open the reportLowThe mathematical calculationLithium Finance Ⅳ · CertiK · 13 Dec 2022Acknowledged
We would like the client to provide with us more information about the calculation of the `balanceOf()`. The mathematical models are not in the scope of this audit.
Open the reportLowThe source of the `_signature`Lithium Finance Ⅳ · CertiK · 13 Dec 2022Acknowledged
We would like to know where the `_signature` come from when a price expert is trying to create an answer.
Open the reportLowThird Party DependencyLithium Finance Ⅳ · CertiK · 13 Dec 2022Acknowledged
The contract is serving as the underlying entity to interact with one or more third-party protocols. The audit scope treats third-party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=623 address _token, ``` - The function `EnquiryPool._transferInToken` and `EnquiryPool._transferOutToken` interacts with the third-party contract with `IERC20` interface via `_token`.
Open the reportLowTwo kind of tokens to stakeLithium Finance Ⅳ · CertiK · 13 Dec 2022Acknowledged
The use of two different stake tokens for each enquiry may add complexity and potentially cause issues. It is unclear why this design was made and we are looking forward to any information about the necessity of using it.
Open the reportLowUnlimited MintingLithium Finance Ⅳ · CertiK · 13 Dec 2022Acknowledged
There is no cap for the max total minting amount of the `RP_Token`, hence the token could be minted unlimitedly.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="lithium-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us