As of 3 Nov 2026, PEAKDEFI has 1 audit report on Trustblock, by Quantstamp, dated 30 Oct 2020. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| PEAKDEFI | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 11 | 4 |
When migrating the `PeakDeFiFund` to a new version, `migrateOwnedContractsToNextVersion` function does not transfer the ownership of `peakReferralToken` which will break token deposit and withdrawal, since the new contract won't own the `peakReferralToken`.
Open the reportPeak token cap is fixed to five billions, `_interestRateFactor` function is supposed to return zero rate after 5 billions cap. However, the function will throw instead since `SafeMath.sub` is used. As a consequence `PeakStaking` contract will be inaccessible after that the max cap is reached, disallowing new managers to join.
Open the reportExternal signature won't work since `msg.sender` won't be equal to `address(this)`. As an example, if user A calls `PeakDefiFund.createInvestmentWithSignature` that does a delegate call to `PeakdefiLogic.createInvestmentWithSignature` the `msg.sender` value will still be equal to user A address, once all ECDSA verifications pass with the signature of user B, `createInvestmentV2` is called without using the keyword `this.createIn...` meaning that the `msg.sender` value will still be equal to the initial sender (user A), The requirements that checks if `msg.sender == _sender || msg.sender == address(this)` will throw since both condition are wrong. Affected function: - `PeakDefiLogic.createInvestmentWithSignature()`. - `PeakDefiLogic.sellInvestmentWithSignature()`. - `PeakDefiLogic.createCompoundOrderWithSignature()`. - `PeakDefiLogic.sellCompoundOrderWithSignature()`. - `PeakDefiLogic.repayCompoundOrderWithSignature()`.
Open the reportAs per the [specification](https://peakdefi.gitbook.io/peakdefi/for-investors/staking-peak) `PeakStaking._interestRateFactor` does not seem to implement "Bigger Bonus Daily".
Open the report`initTokenListings` does not check if the listed compound tokens are set in the compound order factory. Adding a token that is not listed may lead to unexpected behaviour.
Open the report`PeakdefiFactory` `createFund` and all initialisation functions do not implement any authorisation mechanism, depending on how often `PeakDefiFund`s are deployed, an attacker can front run a transaction to set initialisation parameters to its own.
Open the reportThe version of `@openzeppelin/contracts`, `@uniswap/v2-periphery`, and `@uniswap/v2-core` are not locked in `peakdefi-contracts` and the version of `@openzeppelin/contracts` is not locked in `peakDeFi-token`. This entails some risk of unexpected behaviours due to updates of contracts in these packages.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="peakdefi-1"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us