Oikos Cash security record
As of 27 Oct 2026, Oikos Cash has 1 audit report on Trustblock, by QuillAudits, dated 30 Apr 2025. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Oikos | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Findings12
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 7 | 0 | 3 |
LowAmbiguity in onlyVault modifier allows both vault and staking contract to call protected functionsOikos · QuillAudits · 30 Apr 2025Open
The onlyVault modifier in the staking contract is currently ambiguous, allowing both the vault and staking contract to call functions protected by this modifier. This could lead to confusion about which contract is intended to have exclusive access to these functions.
Open the reportLowIdentical Function Signatures: mintTokens(address,uint256) in Multiple ContractsOikos · QuillAudits · 30 Apr 2025Open
Both LendingVault::mintTokens() and NomaFactory::mintTokens() share the same function selector f0dda65c. This could lead to confusion in logs, tooling, or proxy setups, especially in cases where introspection or low-level calls are involved.
Open the reportLowMismatched NatSpec comments and code structures can cause confusionOikos · QuillAudits · 30 Apr 2025Open
The codebase contains NatSpec comments that do not accurately reflect the corresponding code structures. This mismatch can lead to confusion for devs trying to understand the intended functionality and usage of these structures
Open the reportLowMissing Lender Controls Over Loan RolloversOikos · QuillAudits · 30 Apr 2025Open
The rollLoan function allows borrowers to extend (roll) their loan duration and increase borrow amounts, without any lender-side constraints or approval. There is no restriction on the number of rollovers, total duration, or borrower eligibility.<br>As a result:<br>- Borrowers may infinitely roll their loans<br>- Lenders may be locked into illiquid positions<br>- There is no mechanism for lenders to enforce repayment or liquidation, despite borrower expiry or
Open the reportLowMissing or Extra Struct Variables Compared to DocstringsOikos · QuillAudits · 30 Apr 2025Open
Multiple struct definitions in the codebase contain discrepancies between their declared fields and the comments/documentation provided. This creates confusion and increases the likelihood of bugs, misconfigurations, or developer misunderstanding.<br>1. Struct: RewardParams<br>2. Missing: imv, spotPrice, totalSupply, kr<br>3. Unexpected: totalStaked (not mentioned in comment)<br>4. Struct: ProtocolParameters<br>5. Docstring omits: shiftAnchorUpperBips, slideAnchorUpperBips, and all the fee-related fields<br>6. These may be valid additions, but comments should be updated accordingly<br>7. Struct: LiquidityInternalPars<br>8. Docstring doesn’t match the struct at all — likely refers to a different struct entirely<br>9. The struct itself is clear, but needs correct documentation
Open the reportLowRedundant condition in TokenFactory's _deployNomaToken functionOikos · QuillAudits · 30 Apr 2025Open
The _deployNomaToken function in TokenFactory.sol contains a redundant condition that checks if the proxy address is greater than or equal to _token1. This check is unnecessary because the logic of the do...while loop already ensures that this condition will never be true when the loop exits.
Open the reportLowUnused modifiersOikos · QuillAudits · 30 Apr 2025Open
There are few modifiers which are not used in contracts.<br>- onlyVault in LendingVault<br><br>The codebase contains several unused functions, variables, and libraries that contribute to unnecessary complexity and potential confusion for developers and auditors. These unused elements can obscure the code's true functionality and make maintenance more challenging.<br><br>- MockNomaTokenRestricted.sol and Bootstrap.sol are unused.<br><br>- In StakingVault.sol, the LiquidityOps library and functions _collectLiquidity and _transferExcessBalance are defined but not used.<br><br>- In NomaFactory.sol, the teamMultiSig address is declared but never set, rendering it ineffective.<br><br>- In Presale.sol, the variables MIN_CONTRIBUTION and MAX_CONTRIBUTION are calculated in the constructor but never used.<br>
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="oikos"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us