Maverick Protocol security record
As of 14 Oct 2026, Maverick Protocol has 3 audit reports by 2 security firms on Trustblock; the latest is by ABDK Consulting, dated 11 May 2023. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Maverick Phase 2 audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Maverick Protocol audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Maverick Protocol | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings191
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 9 |
| Medium | 0 | 7 | 15 |
| Low | 0 | 65 | 93 |
HighCentralization Related RisksMaverick Protocol · CertiK · 21 Apr 2022Acknowledged
In the contract Pool.sol the role `factory.owner` has authority over the function `claimProtocolFees()`. Any compromise to the `owner` account may allow a hacker to take advantage of this authority.
Open the reportHighMissing Router Restrictions on `Pool.addLiquidityMaverick Protocol · CertiK · 21 Apr 2022Acknowledged
Our current understanding is that the `addLiquidity()` and `removeLiquidity()` functions in Pool.sol should be only called by the Router contract, such that the related token transferring logics are successfully triggered in Router. The `addLiquidity()` and `removeLiquidity()` functions in Router.sol are the actual accessible points for external users to interact with. If `Pool.removeLiquidity()` is meant to be called by external users, then the balance of base and quote tokens should be that of a `msg.sender` instead of that of the contract address (`address(this)`). In addition, there are some possible math simplifications, like in `addLiquidity()`, the `quoteFeeEscrow` is added to `totalQuoteBalance`, subtracted when calculating `quoteIn`, and finally used added with `quoteIn` again in the function call of `_setLiquidity()`
Open the reportMediumThe previously set vote reward is not removed from trasferrers.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportMediumThe returned value is ignored here.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportMediumThe returned value is ignored.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportMediumThe returned value is ignored.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportMediumThese functions could be called several times effectively changing previous values.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportMediumThis code is executed even when ”payer” is not this contract.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportMediumRisks of Using `balance` of an Address for SwappiMaverick Protocol · CertiK · 21 Apr 2022Acknowledged
Using `address(this).balance` or `token.balanceOf(address(this))` as the `inputAmount` is risky. Function `swapEthForToken()` in contract Router and functions `sellTokenForToken()`, `sellEthForToken()` and `sellTokenForETH()` in ZeroExRouter are functions that swaps between tokens and tokens (or between ETH and tokens). When the direction is swapping ETH to token, the amount to be swapped should be the attached `msg.value` in the specific transaction. When the direction is swapping token to ETH or token to token, the amount to be swapped should be the `msg.sender`'s input amount, which need to be pointed out by the function caller as a function parameter. Take `ZeroExRouter.sellTokenForToken()` as an example. A userA want to sell tokenA for tokenB, and the recipient is userA itself. The userA should first transfer amountA of tokenA to the contract (`tx-a1`), and then call `sellTokenForToken(tokenA, tokenB, userA, minAmount, )` (`tx-a2`). A hackerZ can monitor the pattern of the two transactions. The hackerC can wait for the execution of userA's `tx-a1`, and then front run userA's `tx-a2`, with `sellTokenForToken(tokenA, tokenB, hackerZ, minAmount, )` (`tx-z1`) to take advantage of userA.
Open the reportLowBad datatype in RewardBase.solMaverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBad datatype in RewardSingle.solMaverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowBad naming in Distributor.solMaverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowBad naming in RewardOpen.solMaverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowNo access level specified for these variables, so internal access will be used by default.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowNo access level specified for these variables, so internal access will be used by default.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowProcedural in PoolPositionBase.solMaverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowProcedural in PoolPositionDynamic.solMaverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in Distributor.solMaverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in Distributor.solMaverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in Poll.solMaverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowSuboptimal in PoolPositionAndRewardFactory.solMaverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in PoolPositionAndRewardFactory.solMaverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in PoolPositionBase.solMaverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in RewardBase.solMaverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in RewardOpen.solMaverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowThis assignment should be done only when lockDuration >= minLockDuration Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowThis code fills in-storage arrays with zero values.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review the ”clip” function used here.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review these files.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review these files.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowWe didn’t review these files.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review these files.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review these files.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review these files.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review these files.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review these files.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review this file.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review this file.Maverick Phase 2 audit · ABDK Consulting · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in Pool.solMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowDeploying a separate instance of the ”Pool” contract for each pair consumes lots of gas.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowIn ERC20 the ”decimals” property is used by UI to render token amounts in a human-friendly way.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowIn ERC20 the ”decimals” property is used by UI to render token amounts in a human-readable way.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowIn ERC20 the ”decimals” property is used by UI to render token amounts in a human-readable way.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowProcedural in Passport.solMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowProcedural in Pool.solMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowReadability in BinMath.solMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowReadability in BinMath.solMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowReadability in BinMath.solMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowReadability in BinMath.solMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowReadability in BinMath.solMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowReadability in BinMath.solMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowReadability in BinMath.solMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowReadability in BinMath.solMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowReadability in Math.solMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in BinMap.solMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in Pool.solMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowThe ”counter” return value is redundant.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowThe swap direction is unclear from the arguments.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowThis function calculates something that differs from both, weighted moving average and exponential moving average, as ”self.twa” could include values observed before the current loMaverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowThis function is overcomplicated and inefficient.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowThis loop doesn’t scale and could exceed the block gas limit.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowThis maximum tick value means that the allowed price range is from 1e-10 to 1e10, which doesn’t looks sufficient.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review these files.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review these files.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review these files.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review this file.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review this file.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowWe didn’t review this file.Maverick Protocol audit · ABDK Consulting · 13 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowGas Optimization on `uint` and `int` ValuesMaverick Protocol · CertiK · 21 Apr 2022Acknowledged
This finding is not a security issue. We noticed that `uint8` ,`uint16`, `uint32`, `int128`, `uint224`, etc. are used for variable type declaration. We would like to mention that all other `int` types except `int256` would be implicitly converted to `int256` during code execution, since EVM is designed and works with `256bit/32byte`. The implicit conversion would lead to extra gas cost. Here attached an example showing the gas cost: ```solidity pragma solidity 0.8.4; contract A { //69729 gas uint8 a = 0; } contract B { //69324 gas uint256 a = 0; } ```
Open the reportLowIncompatibility With Deflationary Tokens(Swap)Maverick Protocol · CertiK · 21 Apr 2022Acknowledged
When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged transaction fee. As a result, an inconsistency in the amount will occur and the transaction may fail due to the validation checks.
Open the reportShow 4 more
LowLack of Pool Validity ChecksMaverick Protocol · CertiK · 21 Apr 2022Acknowledged
In Router and ZeroExRouter, when the pool address is about to be used, it would be get from `factory.lookup()`. The return value of `factory.lookup()` is from the mapping of `pools[poolKey]`. However, there's no sanity check to validate if a pool exists. It is possible that the pool is never created, and the `pools[poolKey]` is the default `address(0)`.
Open the reportLowMissing Proper Handling of `msg.value`Maverick Protocol · CertiK · 21 Apr 2022Acknowledged
Functions `Router.swap` and `ZeroExRouter.sellEthForToken()` are declared with the `payable` keyword. However, the `msg.value` is never handled if the function is invoked in a transaction. (This finding is related to CKP-01 Risks of Using `balance` of an Address for Swapping)
Open the reportLowThird Party DependenciesMaverick Protocol · CertiK · 21 Apr 2022Acknowledged
The contract is serving as the underlying entity to interact with third party 0x protocol and prb-math library. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc. Note that ZeroExRouter.sol is relied on the liquidity function interface of 0x protocol.
Open the reportLowVariables Could Be Declared ImmutableMaverick Protocol · CertiK · 21 Apr 2022Acknowledged
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="maverick-protocol"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us