MAXIMUS security record
As of 3 Nov 2026, MAXIMUS has 1 audit report on Trustblock, by Paladin, dated 23 Dec 2021. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Audit Report | Security firm: Paladin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · paladinsec.co |
Findings53
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 6 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 15 | 28 |
High_harvest deposits the whole JOE contract balance which allows an exploiter to mint and dump huge amounts of MAXIMUS tokens similar to exploits PancakeBunny has witnessed in the pastAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportHighThe addLiquidity call to create an LP pair allows for value inflation exploits which allow an exploiter to mint and dump Maximus with profitAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportHighThe system design, which is based on PancakeBunny, is extremely brittle with regards to native token securityAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportHighWAVAX.withdraw will fail as the contract is upgradeableAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportHighwithdrawUnderlying and getReward round shares amount down allowing for potentially severe exploits that could lead to loss of all staked fundsAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportHighwithdrawUnderlying and getReward round shares amount down allowing for potentially severe exploits that could lead to loss of all staked fundsAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportMediumReward mechanism can cause withdrawals to be permanently blocked if governance wrongly configures the vaultsAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportMediumVault does not support staking JOE token, reflective tokens and tokens that allow for reentrancyAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportMediumVault does not support staking JOE token, reflective tokens and tokens that allow for reentrancyAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLow_depositStakingToken and _withdrawStakingToken always return zeroAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportShow 10 more
Low_vaultList is privateAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowConstructor sets constant parameters which are outdatedAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowDepositing right before a harvest could allow for slight arbitrageAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowGas optimization: canMint check is redundantAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowGas optimization: price of Maximus can be cachedAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowGas optimization: Unnecessary precision multiplicationAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowGovernance functions unnecessarily wrap addresses to IERC20 while they can just accept IERC20 as the argumentAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowGovernance privilege: Lack of validation on setWithdrawalFeeFreePeriod could allow governance to force the 5% withdrawal fee on all stakersAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowGriefing exploit: migrate allows users to deposit into another user resetting their withdrawal fee timerAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowLack of events for addVault, updateVault, setMinter, setMaximusPerSec and recoverTokenAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportShow 10 more
LowLack of events for setKeeper, setMinter and setMaximusChefAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowLack of events for setRewardsDistributionAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowLack of events for transferMaximusOwner, setWithdrawalFee, setPerformanceFee, setWithdrawalFeeFreePeriod, setMinter, setMaximusChef, setFloatingRateEmission, setFREThresholdAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowLack of origin parameter in staked eventAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowMaximusChef is unusedAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowmintFor returns early if maximusAVAXAmount is zero, causing the user to not receive their Maximus rewardAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowOnly supports Maximus as staking token and Maximus/WAVAX LP as rewards tokenAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowRounding vulnerability to tokens with a very large supply can cause large supply tokens to receive zero emissionsAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowSupposedly has JOE as the staking token yet the balances are denominated in xJOEAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowTypographical errorAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportShow 7 more
LowTypographical errorAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowUnnecessary comparison to trueAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowUsage of chained initializersAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowUsage of raw addition instead to SafeMathAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowWhitelistUpgradeable might need unchanged initializerAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowWithdrawn event might emit wrong third parameterAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportLowZap functions will malfunction for reflective tokensAudit Report · Paladin · 23 Dec 2021Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="maximus-farm"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us