Matchain security record
As of 3 Nov 2026, Matchain has 1 audit report on Trustblock, by QuillAudits, dated 26 Aug 2024. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Matchain | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Findings7
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 3 | 0 | 0 |
| Low | 4 | 0 | 0 |
MediumA malicious user can grief and DOS a user while he is trying to remove LiquidityMatchain · QuillAudits · 26 Aug 2024Open
The removeLiquidityWithPermit() and removeLiquidityETHWithPermit() use permit function to give approve to router contract for the LP tokens and removal of liquidity in the same transaction rather than approving the LP token manually from contract address.• User signs their LP tokens and provides the signature(v,r,s) to contract as part of approving token using permit. • When a user calls removeLiquidityWithPermit or removeLiquidityETHWithPermit function the malicious user see's the transaction in mempool and take the signature of user and calls the permit function himself before the user's transaction gets executed. • Since the signature provided by malicious user is correct the transaction get's successful and increases the nonce. • However, when user's transaction gets executed it would fail due to increase of nonce.
Open the reportMediumDifferent solidity versions used may cause vulnerabilityMatchain · QuillAudits · 26 Aug 2024Open
The contract specifies multiple conflicting Solidity versions in its pragma statements. This is contradictory and will cause compilation errors, as a contract can only be compiled with one specific version of Solidity. Using different Solidity versions may introduce vulnerabilities.
Open the reportMediumUsing payable.transfer might be problematicMatchain · QuillAudits · 26 Aug 2024Open
The usage of transfer so send msg.value is not recommended due to it’s strict dependency upon gas i.e. 2300 gas. If gas costs are subject to change, then smart contracts can’t depend on any particular gas costs. Moreover, the function might fail mid-execution is it requires more than 2300 gas.
Open the reportLowInconsistent version specifiersMatchain · QuillAudits · 26 Aug 2024Open
You're using both strict (=) and caret (^) version specifiers. The caret allows any version from 0.4.18 up to, but not including, 0.5.0, which could lead to unexpected behavior if the contract is compiled with different minor versions.
Open the reportLowLow test coverageMatchain · QuillAudits · 26 Aug 2024Open
Unit tests are used to ensure that the code functions as expected by passing in varying user input and setting up various parameters to test the boundaries of the protocol. There are no unit test cases associated with the codebase provided, hereby increasing the probability of bugs being present and reducing quality assurance.
Open the reportLowProtocol's structure might be confusingMatchain · QuillAudits · 26 Aug 2024Open
Readability and Maintainability: Combining all interfaces and libraries into a single contract can make the contract difficult to read and maintain. It’s usually better to separate concerns by having distinct contracts for different functionalities.• Complexity: A single contract handling all aspects of a protocol can become overly complex, making it harder to debug and test individual components. • Gas Costs: Large contracts can be more expensive to deploy and interact with due to higher gas costs.
Open the reportLowUse an outdated version of the solidityMatchain · QuillAudits · 26 Aug 2024Open
Versions 0.5.16 and especially 0.4.18 are quite old and lack important security features and optimizations present in newer versions. Using outdated compiler versions can lead to security vulnerabilities.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="matchain"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us