As of 3 Nov 2026, NetWeave has 1 audit report on Trustblock, by QuillAudits, dated 28 May 2024. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| NetWeave Finance | Security firm: QuillAudits | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · quillaudits.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 2 | 0 |
| Low | 0 | 3 | 2 |
It was observed that most of the privileged functionality is controlled by the admin. Additional authorization levels are needed to implement the principle of least privilege, also known as least authority, which ensures only authorized processes, users, or programs can access necessary resources or information. Although the contract defines roles responsible for various actions, they can be bypassed by admin. Code Location: The owner can access those functions in Comptroller contract: • _setRewardDistributor • _setPriceOracle • _setCloseFactor • _setCollateralFactor • _setMaxAssets • _setLiquidationIncentive • _supportMarket The owner can bypass role-based access control of those functions in Comptroller: • _setMarketBorrowCaps • _setMintPaused • _setBorrowPaused • _setTransferPaused • _setSeizePaused
Open the reportIn contract comptroller, in borrowAllowed() function it is checking for the price if it is 0 but it is not checking for the staleness of the returned price from the latestRoundData() in _getChainLinkPrice function in ChainLinkOraclePrice.sol
Open the reportIn contract comptroller, in _setCloseFactor() function there should be a check range between values but it is not present which can cause issue that value might go out of mentioned range. The mentioned range in contract is between min: 0.05e18 and max: 0.09e18
Open the reportIn contract comptroller, while the function updates new RewardDistributor address in _setRewardDistributor but if old RewardDistributor contract is not empty then proper rewards might not even be distributed
Open the reportIn contract RewardDistributor, grantRewardInternal uses transfer for eth transfer on payable user.The use of the deprecated transfer() function for an address will inevitably make the transaction fail when: • The claimer smart contract does not implement a payable function. • The claimer smart contract does implement a payable fallback which uses more than 2300 gas unit. • The claimer smart contract implements a payable fallback function that needs less than 2300 gas units but is called through proxy, raising the call's gas usage above 2300. Additionally, using higher than 2300 gas might be mandatory for some multisig wallets.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="netweave-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us