OrcaDAO security record

Avalancheavai.financeX

As of 3 Nov 2026, OrcaDAO has 1 audit report on Trustblock, by Paladin, dated 28 Oct 2021. That report lists no open critical findings. It also holds 11 deployed contracts on 1 chain.

Critical findings
No open critical findings
In 1 report.
Open the latest report
Your label, live
Get the label for your site

Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.

Audits1

Newest first

AuditSecurity firmDateScopeCritical findingsReport
Audit Report

Audit

Security firm: PaladinDate: Scope: 11 addresses on AvalancheNo open critical findingsOpen · paladinsec.co

Findings58

Statuses are the security firm’s own, from each report.

SeverityOpenAcknowledgedFixed
Critical000
High003
Medium022
Low23118
MediumendTimestamp logic is wrong causing the farm to stop emitting rewards to lateAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
MediumGovernance privilege: No restrictions on deposit feesAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
Low_orca, _revocable and revoked should be marked as publicAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowAdding a EOA or non-token contract as a pool will break updatePool and massUpdatePoolsAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowAmbiguous naming of treasury vaultAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowAnyone can call a release which might be annoying for the recipient their accountingAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowCalling release before the cliff results in an ambiguous underflow reversionAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowdebtRatio and gainRatio have ambiguous namesAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowdebtRatio can only be set to very distinct values without much flexibilityAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowDeflationary tokens are not supportedAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
Show 10 more
LowEvent parameters are not indexedAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowGas optimization: roles can be cachedAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowGas optimization: roles can be cachedAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowhalfDebt is a misnomerAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowLack of explicit check to validate that the vault is in fact a WAVAX vaultAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowopeningFee is unusedAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowOrca and startTimestamp can be made immutableAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowpendingRewards and updatePool reverts while totalAllocPoint is zeroAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
Lowpermit and delegateBySig can be frontrun causing denial of serviceAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowPrecision vulnerability causes insufficient rewards for certain tokensAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
Show 10 more
LowsetRewardsPerSecond updates historical rewards since the last pool activity as wellAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowsetTreasury and rewardsActive can be made externalAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowsupportsInterface does not return true on all supported interfacesAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowThe changedAddress event is unusedAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowThe contract malfunctions when teammates are added while payments have already been releasedAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowThe receive function is unusedAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowTip: Tracking the debt ceiling within the AVAI contract might be saferAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowtotalShares, totalReleased, shares, released, payee, addPayee and release can be made externalAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowTreasury can be set to the zero address potentially blocking both deposits and withdrawalsAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowTypographical error in the contractAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
Show 3 more
LowTypographical errors in the contractAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowUsing the term vault for the bank address is a misnomerAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report
LowWrongful usage of assertAudit Report · Paladin · 28 Oct 2021Acknowledged

The report gives no description here.

Open the report

Contracts11

AddressChainSource code
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source
Chain: AvalancheSource code: Verified source

All 11 addresses

Show this on your site

Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.

Content

Facts

Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.

Fixed as
Language

Style

Layout
Theme
Accent
Corners

Format

Size
Date
Embed as
HTML
<head>
	<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
</head>
<body>
	<div
		data-tb-project-widget
		data-tb-project-slug="orcadao"
	></div>
</body>

Paste the code where the label should appear. It uses no API credit and updates by itself.

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us