PerlinX security record
As of 22 Oct 2026, PerlinX has 2 audit reports by 1 security firm on Trustblock; the latest is by Quantstamp, dated 19 Aug 2020. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| PerlinXerc20emission | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| PerlinXRewards.sol | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings22
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 1 | 0 |
| Low | 0 | 11 | 8 |
HighA user can increase their shares arbitrarilyPerlinXRewards.sol · Quantstamp · 7 Aug 2020Fixed
`L244` accumulates based on the input amount. In addition, the function `registerAllClaims` can be called by anyone at any time. So one can call the function `registerAllClaims` multiple times to increase its ratio of `memberClaimInEra`/`totalClaimsInEra`.
Open the reportHighMissing balance check after transfer of ERC20 tokenPerlinXRewards.sol · Quantstamp · 7 Aug 2020Fixed
The transfer of ERC20 will not always be successful. Hence, the success of `transferFrom`/`transfer` on `L200`, `225`, `L234`, `L265` should be checked.
Open the reportLowBusiness logic contradicts the codePerlinXerc20emission · Quantstamp · 19 Aug 2020Fixed
The `.div(baseline)` on `L234` contradicts the comment about `1bn` on `L233`, since `ERC20(perlin1).totalSupply()` is a variable instead of a constant.
Open the reportLowContract is subject to race conditionsPerlinXerc20emission · Quantstamp · 19 Aug 2020Fixed
Due to mining non-deterministic order, `changeEmissionCurve`, `changeEraDuration`, `changeIncentiveAddress` may lead to transaction order dependency situations. ** 2020-08-18 update **: Perlin team added a safety check to the function `changeEraTime()`. For the two other functions, Perlin team stated that the likelihood of this attack is rather small due to: "1) Emissions are only paid (intended) once a day, the likelihood that DAO will adjust params on the same block as the emissions is extremely low and 2) The worse case is the DAO transaction reverts, or the emission transaction reverts" and hence suggested not to modify their code.
Open the reportLowInteger Overflow / UnderflowPerlinXerc20emission · Quantstamp · 19 Aug 2020Fixed
`SafeMath` is not used on `L223`, `L224`.
Open the reportLow`snapshotPoolsInEra` can be called on past erasPerlinXRewards.sol · Quantstamp · 7 Aug 2020Fixed
Currently, it is possible to call `snapshotPoolsInEra` on past eras, that is, on eras whose value is less than `currentEra`.
Open the reportLow`updateRewards` may run out of gasPerlinXRewards.sol · Quantstamp · 7 Aug 2020Fixed
The loop in `updateRewards` expects the pool count to be less than `100`; however, the code does not bound `arraySynths` in any manner. If not controlled for, the function `updateRewards` may reach a point of never working again due to high gas costs. P.S. The Perlin team said that they're aware of this and the loop count is planned to be less than 100, so it might not be a problem as long as this maximum loop count is being carefully maintained.
Open the reportLowIncorrect weight precisionPerlinXRewards.sol · Quantstamp · 7 Aug 2020Fixed
On `L124`, the requirement statement checks that the weight is greater than or equal to `1` and less than or equal to `1000`. The corresponding message says: "Must be greater than 0.1, less than 10". Taking `1000` to be the baseline, the contract is representing the weight with two decimal precision; hence 1 shall denote `0.01`, instead of `0.1` as the message suggests. An incorrect requirement statement message may inadvertently convey the incorrect precision, which could cause callees to incorrectly adjust the weight as a consequence.
Open the reportLowModifier `flashSafe()` cannot avoid flash loan and reentrancyPerlinXRewards.sol · Quantstamp · 7 Aug 2020Fixed
An attacker’s TX could pass this modifier by using multiple contracts to change their `msg.sender`.
Open the reportLowUnlocked PragmaPerlinXRewards.sol · Quantstamp · 7 Aug 2020Fixed
Every Solidity file specifies in the header a version number of the format `pragma solidity (^)0.4.*`. The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked." For consistency and to prevent unexpected behavior in the future, it is recommended to remove the caret to lock the file onto a specific Solidity version.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="perlin"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us