OpenSky security record
As of 21 Oct 2026, OpenSky has 2 audit reports by 2 security firms on Trustblock; the latest is by CertiK, dated 5 Sep 2022. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Opensky Finance | Security firm: CertiK | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · skynet.certik.com |
| OpenSky Finance: OpenSky audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings51
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 4 | 0 | 1 |
| Medium | 1 | 2 | 6 |
| Low | 4 | 1 | 31 |
CriticalAnyone Can Move Out All the Tokens via `claimERC2Opensky Finance · CertiK · 5 Sep 2022Fixed
`OpenSkyOToken` allows to deposit `_underlyingAsset` and get `oTokens` instead. However, anyone can move out all the tokens including `_underlyingAsset` to `_treasury()` via call to `claimERC20Rewards()`. This makes claiming of `oTokens` impossible.
Open the reportHigh`outAmount` is refunded twice by `OpenSkyWETHGateOpensky Finance · CertiK · 5 Sep 2022Fixed
`OpenSkyWETHGateway.extend()` refunds `outAmount` to `msg.sender` if positive. But `lendingPool.extend()` also transfers it directly to `newLoan.borrower` by the call to `ReserveLogic.extend()`. `newLoan.borrower` is set as `loanNFT.ownerOf(oldLoanId)` if `lendingPool.extend()` is called by `SETTINGS.wethGatewayAddress()`.
Open the reportMedium`OpenSkyPunkGateway` doesn't `repay()` penaltyOpensky Finance · CertiK · 5 Sep 2022Fixed
`OpenSkyPunkGateway.repay()` and `repayETH()` perform transfer to `address(this)` of `loanNFT.getBorrowBalance(loanId)`. This amount **doesn't include penalty**. `OpenSkyPunkGateway._repay()` then performs `approve()` of the same `borrowBalance` to `poolAddress()` and calls `poolAddress().repay()`. `OpenSkyPool.repay()` has `repayAmount = borrowBalance + penalty`. `ReserveLogic.repay()` is called with the same `amount` argument. It transfers tokens from `OpenSkyPunkGateway` to `reserve.oTokenAddress`. The transfer will fail since the amount approved is less then transferred.
Open the reportMedium`OpenSkyWETHGateway` allows to `repay()` loans byOpensky Finance · CertiK · 5 Sep 2022Fixed
If `OpenSkyWETHGateway` contract has non zero `WETH` balance for some reason, it can be used by anyone to repay the loans. `OpenSkyWETHGateway.repay()` can be called with zero `msg.value`. Infinite `WETH` was already approved to `lendingPool` and will be used by `lendingPool.repay()`. `extend()` is also affected.
Open the reportMedium`supportsInterface()` calls itselfOpensky Finance · CertiK · 5 Sep 2022Fixed
`OpenSkyLoan.supportsInterface()` calls itself instead of `super` version.
Open the reportMediumUsage of `safeTransferFrom(address(this)` for ERCOpensky Finance · CertiK · 5 Sep 2022Fixed
```solidity=170 IERC20(_underlyingAsset).safeTransferFrom(address(this), to, amount); ``` There is no need to use `safeTransferFrom()` with `this` as spender. Also, the contract has not approved itself to spend own tokens, the call will fail.
Open the reportMediumMismatched IncentiveController Invocation in OpenSkyOTokenOpenSky Finance: OpenSky audit · PeckShield · 9 Jun 2022Fixed
The report gives no description here.
Open the reportMediumProper Use of Borrow Rate in OpenSkyPool::borrow()OpenSky Finance: OpenSky audit · PeckShield · 9 Jun 2022Fixed
The report gives no description here.
Open the reportLow`basePriceData` can be declared as `storage` to sOpensky Finance · CertiK · 5 Sep 2022Fixed
`basePriceData` structure is declared as `memory`. Several `nftPriceFeedMap` elements are fully copied from `storage` into `memory`.
Open the reportLow`borrowETH()` emits both `Borrow` and `BorrowETH`Opensky Finance · CertiK · 5 Sep 2022Fixed
`borrowETH()` emits `Borrow` and `BorrowETH` events. `repayETH()` emits `Repay` and `RepayETH` events.
Open the reportShow 10 more
Low`check msg.value` comment is misleadingOpensky Finance · CertiK · 5 Sep 2022Fixed
`check msg.value` comment is misleading. There is no `msg.value`.
Open the reportLow`MONEY_MARKET_DEPOSIT_AMOUNT_ALLOWED` name is misOpensky Finance · CertiK · 5 Sep 2022Fixed
`MONEY_MARKET_DEPOSIT_AMOUNT_ALLOWED` error name is supposed to be `MONEY_MARKET_DEPOSIT_AMOUNT_NOT_ALLOWED`.
Open the reportLow`OpenSkyWETHGateway.constructor()` comment is misOpensky Finance · CertiK · 5 Sep 2022Fixed
The comment states `Infinite approves OpenSky pool`, however, it doesn't. Separate functions `authorizeLendingPool()` and `authorizeLendPoolNFT()` are responsible for that.
Open the reportLow`Repay` event should emit `nftReceiver` addressOpensky Finance · CertiK · 5 Sep 2022Fixed
`IOpenSkyPool Repay` event has argument `onBehalfOf The address that will receive the pledged NFT`. However, `onBehalfOf` is emitted instead of `nftReceiver`.
Open the reportLowChecking if `amount > 0` is uselessOpensky Finance · CertiK · 5 Sep 2022Fixed
```solidity=140 uint256[] memory ids = new uint256[](amount > 0 ? amount : 0); if (amount > 0) { for (uint256 i = 0; i < amount; ++i) { ``` `amount > 0` checks are redundant, don't affect the functionality.
Open the reportLowCommented Out CodeOpensky Finance · CertiK · 5 Sep 2022Fixed
The linked lines have commented out code that is redundant and can be deleted.
Open the reportLowContract Size Exceeds LimitOpensky Finance · CertiK · 5 Sep 2022Fixed
The linked contracts have a code size that exceeds 24576 bytes, so they may not be deployable on the mainnet.
Open the reportLowError message `DEPOSIT_PUNK_NOT_OWNER_OF_PUNK` isOpensky Finance · CertiK · 5 Sep 2022Fixed
Error message `DEPOSIT_PUNK_NOT_OWNER_OF_PUNK` is supposed to be `BORROW_NOT_OWNER_OF_PUNK`
Open the reportLowImproper Usage of `public` and `external` TypeOpensky Finance · CertiK · 5 Sep 2022Fixed
`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.
Open the reportLowInconsistent Comment and CodeOpensky Finance · CertiK · 5 Sep 2022Fixed
The comment above the function `endLiquidation()` from contract `ReserveLogic` states "Implements the start liquidation feature". There is an inconsistency issue with the "start" and "end" wording. The comment on the contract `OpenSkyInterestRateStrategy` references the value `OPTIMAL_USAGE_RATIO` which is never used, while the code does reference a value `OPTIMAL_UTILIZATION_RATE`.
Open the reportShow 10 more
LowInconsistent Contract File NamingOpensky Finance · CertiK · 5 Sep 2022Fixed
The file `interfaces/IOpenSkyMoneymarket.sol` has 'm' in lowercase. But it is imported as `IOpenSkyMoneyMarket.sol`. This can cause a problem on [different file systems](https://docs.soliditylang.org/en/v0.8.13/path-resolution.html#import-callback).
Open the reportLowInconsistent Functionality NamingOpensky Finance · CertiK · 5 Sep 2022Fixed
Along with the project's codebase, there are references to Flash Loans, but the functionality that resembles that logic is called "FlashClaim".
Open the reportLowIncorrect comments and argument names of `ReserveOpensky Finance · CertiK · 5 Sep 2022Fixed
```solidity=119 * @param ethIn The amount of ETH that will be deposited * @param ethOut The amount of ETH that will be withdrawn ``` `extend()` doesn't work with Ether, it works with any underlying ERC20 token.
Open the reportLowMissing `checkReserveExists` modifierOpensky Finance · CertiK · 5 Sep 2022Fixed
Functions working with `reserves` should check if reserve exists.
Open the reportLowMissing Emit EventsOpensky Finance · CertiK · 5 Sep 2022Fixed
There should always be events emitted in the sensitive functions that are controlled by centralization roles.
Open the reportLowMissing Error MessagesOpensky Finance · CertiK · 5 Sep 2022Fixed
The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.
Open the reportLowMissing Zero Address Validation on OpenSkyPriceAgOpensky Finance · CertiK · 5 Sep 2022Fixed
The linked addresses are not checked before being used to make sure they are not the zero address.
Open the reportLowPotential Reentrancy AttackOpensky Finance · CertiK · 5 Sep 2022Fixed
A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. A user can create a malicious contract that calls `flashClaim()` and that in its implementation of the function `executeOperation()`, the contract calls the function `flashClaim()` again, starting a new flash loan with different parameters. This could allow a malicious user to start a series of malicious transactions involving different smart contracts, as the new calls to `flashClaim()` can point to different `receiver` addresses.
Open the reportLowThird Party DependenciesOpensky Finance · CertiK · 5 Sep 2022Fixed
The contract is serving as the underlying entity to interact with third party `Aave` and `Uniswap` protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.
Open the reportLowTyposOpensky Finance · CertiK · 5 Sep 2022Fixed
There are several typos in the code's comments. - aidrop should be airdrop. - backword should be backward. - computated should be computed. - curreBalanceScaled should be currentBalanceScaled. - excuted should be executed. - OWERFLOW should be OVERFLOW. - stucked should be stuck. - SUFFIENCE should be SUFFICIENT. - "The rate will be set" should be "The rate to be set".
Open the reportShow 9 more
LowUnchecked Value of ERC-20 `transfer()`/`transferFOpensky Finance · CertiK · 5 Sep 2022Fixed
The linked `transfer()`/`transferFrom()` invocations do not check the return value of the function call which should yield a `true` result in case of a proper ERC-20 implementation.
Open the reportLowUnnecessary ABIEncoderV2 PragmaOpensky Finance · CertiK · 5 Sep 2022Fixed
The linked line explicitly specifies `pragma ABIEncoderV2`, which is unnecessary due to the feature being enabled by default in Solidity v0.8.0 and above.
Open the reportLowUnnecessary Usage of SafeMath LibraryOpensky Finance · CertiK · 5 Sep 2022Fixed
For Solidity version 0.8.x, the SafeMath library is no longer needed because native math operations are already safe and cheaper.
Open the reportLowUnused Import FilesOpensky Finance · CertiK · 5 Sep 2022Fixed
The linked `import` statements include a contract or library which is not used in the file that imports such files.
Open the reportLowUnused Return ValueOpensky Finance · CertiK · 5 Sep 2022Fixed
The return value of the linked external calls are not used. This can cause unexpected errors.
Open the reportLowUsage of `msg.sender` instead of `_msgSender()`Opensky Finance · CertiK · 5 Sep 2022Fixed
The function `withdraw()` from contract `OpenSkyPool` uses `msg.sender` to retrieve the sender of the transaction instead of using the function `_msgSender()`. Given that the function is inherited from the contract `Context`, the return value will be the same, but there will be consistency across the contract.
Open the reportLowVariables That Could Be Declared as ImmutableOpensky Finance · CertiK · 5 Sep 2022Fixed
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportLowPotential Reentrancy Risk in OpenSkyDutchAuctionOpenSky Finance: OpenSky audit · PeckShield · 9 Jun 2022Fixed
The report gives no description here.
Open the reportLowSafe-Version Replacement With safeTransfer() And safeTransferFrom()OpenSky Finance: OpenSky audit · PeckShield · 9 Jun 2022Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="opensky-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us