Neemo Finance security record
As of 3 Nov 2026, Neemo Finance has 4 audit reports by 1 security firm on Trustblock; the latest is by Hacken, dated 12 Feb 2025. Those reports list 1 open critical finding.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Neemo / NeemoLiquifier | Security firm: Hacken | Date: | Scope: Files named in the report | No open critical findings | Open · hacken.io |
| Neemo / Neemo-Staked-Astar | Security firm: Hacken | Date: | Scope: Files named in the report | 1 open critical finding | Open · hacken.io |
| Neemo / Neemo-Restaked-Ether | Security firm: Hacken | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · hacken.io |
| Neemo / Neemo-Staked-Astar / Aug2024 | Security firm: Hacken | Date: | Scope: Files named in the report | No open critical findings | Open · hacken.io |
Findings30
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 1 | 0 | 2 |
| High | 1 | 0 | 3 |
| Medium | 2 | 0 | 3 |
| Low | 5 | 0 | 13 |
CriticalInconsistent Ratios in DappStakingManagerL2 Causing Balances DiscrepanciesNeemo / Neemo-Staked-Astar · Hacken · 4 Feb 2025Fixed
The report gives no description here.
Open the reportCriticalIncorrect ratio application leads to decreasing LST tokens mintsNeemo / Neemo-Restaked-Ether · Hacken · 24 Jan 2025Fixed
The report gives no description here.
Open the reportHighImproper Addition to failedMessageIds in ccipReceive Causes Function RevertNeemo / Neemo-Staked-Astar · Hacken · 4 Feb 2025Fixed
The report gives no description here.
Open the reportHighPotential Unauthorized Fund Transfers via depositDelegateWithMintNeemo / Neemo-Staked-Astar · Hacken · 4 Feb 2025Fixed
The report gives no description here.
Open the reportHighFirst depositor gets overestimated number of LST tokensNeemo / Neemo-Restaked-Ether · Hacken · 24 Jan 2025Fixed
The report gives no description here.
Open the reportMediumState Desynchronization Between L1 and L2 During Contract Pause in _exchangeRateProtectionNeemo / Neemo-Staked-Astar · Hacken · 4 Feb 2025Fixed
The report gives no description here.
Open the reportMediumL2 may continue deposits when L1 is automatically pausedNeemo / Neemo-Restaked-Ether · Hacken · 24 Jan 2025Fixed
The report gives no description here.
Open the reportMediumThe reprice function can revert with arithmethic underflow errorNeemo / Neemo-Restaked-Ether · Hacken · 24 Jan 2025Fixed
The report gives no description here.
Open the reportLowEvent Emission Before State ChangeNeemo / NeemoLiquifier · Hacken · 12 Feb 2025Fixed
The report gives no description here.
Open the reportLowMissing nonReentrant ModifierNeemo / NeemoLiquifier · Hacken · 12 Feb 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowMisleading Revert Message in _exchangeRateProtection for Rate Sync FailureNeemo / Neemo-Staked-Astar · Hacken · 4 Feb 2025Fixed
The report gives no description here.
Open the reportLowMissing Event Emission in startMultichainManager FunctionNeemo / Neemo-Staked-Astar · Hacken · 4 Feb 2025Fixed
The report gives no description here.
Open the reportLowRedundant Assignment of Default Values for currentDeviation and allowedDeviationNeemo / Neemo-Staked-Astar · Hacken · 4 Feb 2025Fixed
The report gives no description here.
Open the reportLowRedundant Checks In claim And claimUnlockingTokens FunctionsNeemo / Neemo-Staked-Astar · Hacken · 4 Feb 2025Fixed
The report gives no description here.
Open the reportLowRedundant Received Amount Assignment in requestWithdraw Increasing Gas UsageNeemo / Neemo-Staked-Astar · Hacken · 4 Feb 2025Fixed
The report gives no description here.
Open the reportLowPossibly unreachable code within the StakingManagerL2's syncStateFromL1 functionNeemo / Neemo-Restaked-Ether · Hacken · 24 Jan 2025Fixed
The report gives no description here.
Open the reportLowThe delegate's referrer can be front-runnedNeemo / Neemo-Restaked-Ether · Hacken · 24 Jan 2025Fixed
The report gives no description here.
Open the reportLowThe validateAmount modifier can be insufficientNeemo / Neemo-Restaked-Ether · Hacken · 24 Jan 2025Fixed
The report gives no description here.
Open the reportLowRedundant Storage Reads Leading to Gas OverheadNeemo / Neemo-Staked-Astar / Aug2024 · Hacken · 4 Sep 2024Fixed
Reading the same storage variables multiple times in a single function will cost more Gas. In the `setTreasury()` function, `treasury` is read twice from storage. The same for `protocolConfig[Configs.REWARD_FEE]` and `protocolConfig[Configs.MINT_FEE]` in the `setRewardFee()` and `setMintFee()` functions. The same for `currentBatchId` for the `syncPeriod()` and `forceSyncPeriod()` functions. And in the `setStakingDapp()` function, `_staking` memory variable could be emitted instead of `stakingDapp` storage variable. The same can be observed for `isStakingActive` variable in the `setStakingActive()` function.
Open the reportLowState Variables That Should Be ImmutableNeemo / Neemo-Staked-Astar / Aug2024 · Hacken · 4 Sep 2024Fixed
In the `DepositWrapper` contract, the `dappStakingManager` and `wASTR` variables are only updated in the constructor. The same for the `accessController` variable in the `PauseController` contract. The variables to be assigned only in the contract's constructor could be set immutable to reduce Gas cost when reading them.
Open the reportShow 1 more
LowUnused ImportNeemo / Neemo-Staked-Astar / Aug2024 · Hacken · 4 Sep 2024Fixed
The `DepositWrapper` contract imports `IERC20` but the import is not used at all. Having unused imports reduces the code readability and increases the complexity.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="neemo-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us