Lulo security record
As of 10 Nov 2026, Lulo has 1 audit report on Trustblock, by Certora, dated 10 Feb 2025. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits1
Newest first
Findings28
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 7 |
| High | 0 | 0 | 4 |
| Medium | 0 | 0 | 8 |
| Low | 0 | 0 | 0 |
CriticalAnchor account state overwrite issue allows attackers to arbitrageLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportCriticalAttacker can make themselves the referrer of existing user accountsLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportCriticalAttackers can arbitrage using the withdraw_all featureLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportCriticalIncorrect computation of referral fee share reduces fees earned by protocolLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportCriticalMissing call to Pool::error_if_stale_refresh function inLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportCriticalReferrers can claim assets by claiming fees from a different allocationLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportCriticalThe complete_regular_withdraw instruction does not update oracles butLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportHighAllocation::update_referrer_on_withdraw function updatesLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportHighIncorrect implementation of oracle update staleness checkLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportHighIncorrect order of operations leads to incorrect total_referred_amount andLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportShow 9 more
HighThe withdraw_protocol function might fail when protocol weight is zeroLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportMediumAttacker can grief refresh_tvl operation by causingLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportMediumKaminoPoolWithdraw::cpi_withdraw incorrectly passes pool input tokenLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportMediumMissing bounds for fee parametersLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportMediumOracle updates fail because of incorrect assignment leading to DoSLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportMediumProtocol weight might become more than the max exposureLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportMediumSmaller refresh_stale_max_seconds can DoS the protocolLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportMediumThe check_protocol_weights might prevent admin from setting protocolLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportMediumThe pool_refresh_kamino_alt instruction lacks security checkLulo · Certora · 10 Feb 2025Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="lulo"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us