Metis security record
As of 2 Nov 2026, Metis has 3 audit reports by 2 security firms on Trustblock; the latest is by QuillAudits, dated 8 Mar 2024. Those reports list 2 open critical findings. It also holds 1 deployed contract on 1 chain.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Metis - Vesting | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| Metis | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| Metis / ERC20 | Security firm: Hacken | Date: | Scope: 1 address on Ethereum | 2 open critical findings | Open · hacken.io |
Findings39
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 2 | 0 | 2 |
| High | 2 | 0 | 5 |
| Medium | 2 | 0 | 5 |
| Low | 3 | 0 | 18 |
CriticalIncorrect Function LogicMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportCriticalUnauthorized AccessMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportHighData ConsistencyMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportHighDenial of Service VulnerabilityMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportHighDenial of Service VulnerabilityMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportHighHighly Permissive Role AccessMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportHighInsufficient BalanceMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportMediumData ConsistencyMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportMediumOvercomplicated ImplementationMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportMediumRedundant ImportMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
MediumUnchecked TransferMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportMediumViolated Checks-Effects-Interactions PatternMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportLowFloating solidity versionMetis - Vesting · QuillAudits · 8 Mar 2024Fixed
Contract has a floating solidity pragma version, ^0.8.20. This is present also in inherited contracts. Locking the pragma helps to ensure that the contract does not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively. The recent solidity pragma version also possesses its own unique bugs.
Open the reportLowIncorrect Input Value SanitizationMetis · QuillAudits · 28 Aug 2023Fixed
At the constructor level where some variables are to be set for the contract, there was a check to ensure that the passed parameters for the minPrice and maxPrice stays between a minPrice lower than maxPrice and a maxPrice below and/or equal to the PRICE_PRECISION. This check will always pass because it checks the state variable instead with the input values passed into the constructor function.
Open the reportLowOwnership Transfer should be a Two-way ProcessMetis · QuillAudits · 28 Aug 2023Fixed
the contract owner plays a critical role to every of the activity happening on the vault; from regulating the claiming of airdrops with the pause and unpause attribute, to the claiming of rMetis remnant in contract, to redeeming Metis on the price ratio of 1:1, to also redeeming slashed fees. It is important to state the safety of ownership transfer to ensure that a mistaken transfer does not cost losing ownership properties to an unintended address or the null address. The transferOwnership in Openzeppelin Ownable contract automatically sets the passed address as the new owner.
Open the reportLowPrevent Deposit Function Call when Msg.value is ZeroMetis · QuillAudits · 28 Aug 2023Fixed
The deposit function can only be called by the owner of the Vesting Vault contract so that the redemption tokens gets minted the exact amount of rMetis token. However, when there is no msg.value sent with the deposit function, no rMetis token is minted but the function is successful. This will cause a waste of gas when called without a native token.
Open the reportLowUnlocked pragma ( pragma solidity ^0.8.0 )Metis · QuillAudits · 28 Aug 2023Fixed
Contracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively.
Open the reportLowVariables without a Setter Function can be set as ImmutableMetis · QuillAudits · 28 Aug 2023Fixed
There are some variables in the contract that only get set at the constructor level but have no other setter functions to change them again in the contract. Making these variables immutable will prevent adding them to the storage slot and instead make them inline with the contract bytecode that gets accessed without overhead gas when needed to perform a functionality. The variables are as follows:• merkleRoot • claimDeadline • startDate • endDate • minPrice • maxPrice
Open the reportLowDuplicated FunctionsMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportLowEmpty FunctionsMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowFloating PragmaMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportLowMissing Zero Address ValidationMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportLowPublic Functions Instead of ExternalMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportLowRedundant Code LineMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportLowRedundant ComparisonMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportLowRedundant FunctionMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportLowRedundant Function UsageMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportLowRedundant Use of SafeMathMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportLowUnused ModifierMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportLowUnused VariableMetis / ERC20 · Hacken · 6 Oct 2022Fixed
The report gives no description here.
Open the reportContracts1
| Address | Chain | Source code |
|---|---|---|
| 0x9e32b13ce7f2e80a01932b42553652e053d6ed8e | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="metis"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us