As of 3 Nov 2026, MaxDAO has 1 audit report on Trustblock, by CertiK, dated 26 Sep 2022. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Newest first
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 0 |
| Medium | 0 | 2 | 2 |
| Low | 1 | 0 | 6 |
The function `setDatetime()` and `setDatetime(uint256 _time)` can be called by anyone as it has no access restriction. This enables anyone to call this and change the `_timedate`
Open the reportIn the function `withdrawToken()`, a certain amount of tokens is supposed to be withdrawn per the `_order` detail. In L935, `_order.amount` will be sent to `msg.sender` in BEP20 contract in `_order.token`. However as the address in `_order.token` is defined in `_saveOrder()`, it could potentially point to a malicious contract, which could include logic that reentrant the MaxDAO contract.
Open the reportFunctions with names starting with `_` should be declared as `private`/`internal`.
Open the reportWhen transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged transaction fee. For example, if a user transfers 100 deflationary tokens through `depositAlone()`, only 90 tokens actually arrived in the contract. However, the user can still take `100` as `_amount` value to calculate `currentValue`. Reference: https://thoreum-finance.medium.com/what-exploit-happened-today-for-gocerberus-and-garuda-also-for-lokum-ybear-piggy-caramelswap-3943ee23a39f
Open the reportThe **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.
Open the reportThe linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.
Open the reportThe `upgrade()` function uses the magic number `210000e18`, while `_burnAmount()` function uses the magic number `30000e18` to calculate tokens that should be burnt
Open the reportThe linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="maxdao"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us