PoolTogether security record

Ethereum, Polygon (POS), Avalanche, BNB Chain, Arbitrum, Optimism, Base, Scrollpooltogether.com X GitHub

As of 15 Jul 2025, Trustblock’s record for PoolTogether holds 8 audit reports by 3 audit firms (Sep 2019 to May 2021). The latest audit is “PoolTogether — Sushi and Yearn V2 Yield Sources” by Consensys, dated 1 May 2021. Those reports list 7 open critical findings.

Critical findings

7 open critical findings

Reported in 3 reports, the latest by Consensys, May 2021. See the findings

Open the latest report Get the label for your site

Record last updated 15 Jul 2025. It holds audits, findings and contracts up to Oct 2026, and incidents up to Sep 2026. Statuses are the audit firms’ own. Trustblock does not review code.

Audits: 8; by 3 firms, Sep 2019 to May 2021
Last audit: 1 May 2021; by Consensys
Audit firms: 3; Consensys, OpenZeppelin and Quantstamp

Issues (78)

	Low	Medium	High	Critical	Total
Not fixed	25	10	5	7	47
Acknowledged	-	-	-	-	0
Fixed	19	5	5	2	31
Total	44	15	10	9	78

Audits (8)

#	Name	Auditor	Date	Chains	Issues
1	PoolTogether — Sushi and Yearn V2 Yield Sources	Consensys	2021/05/01	Multi-Chain	1 open critical finding
2	PoolTogether - Pods	Consensys	2021/03/01	Multi-Chain	4 open critical findings
3	PoolTogether	Consensys	2021/02/01	Multi-Chain	No open critical findings
4	PoolTogether - LootBox and MultipleWinners Strateg	Consensys	2020/11/01	Multi-Chain	2 open critical findings
5	PoolTogether v3 Audit	OpenZeppelin	2020/10/21	Multi-Chain	No open critical findings
6	PoolTogether	OpenZeppelin	2020/04/21	Multi-Chain	No open critical findings
7	PoolTogether Audit	OpenZeppelin	2020/01/16	Multi-Chain	No open critical findings
8	Pool Together 2.0	Quantstamp	2019/09/04	Multi-Chain	No open critical findings

Contracts (39)

#	File Name
1	contracts/UniformRandomNumber.sol
2	contracts/compound/ICErc20.sol
3	contracts/test/ExposedUniformRandomNumber.sol
4	contracts/Pool.sol
5	contracts/test/CErc20Mock.sol
6	contracts/test/ExposedDrawManager.sol
7	contracts/Migrations.sol
8	contracts/test/Token.sol
9	coverage/contracts/TokenDrop.sol.html
10	coverage/lcov-report/contracts/TokenDrop.sol.html

Get your label

Is this your project? Add a free label to your website. It shows the audits published on Trustblock, with the latest firm and date, and links to this page. It updates by itself.

HTML

<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
<div
  data-tb-project-widget
  data-tb-project-slug="pooltogether"
  data-tb-variant="label"
  data-tb-color="light"
></div>

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us

#	File Name
1	contracts/UniformRandomNumber.sol
2	contracts/compound/ICErc20.sol
3	contracts/test/ExposedUniformRandomNumber.sol
4	contracts/Pool.sol
5	contracts/test/CErc20Mock.sol
6	contracts/test/ExposedDrawManager.sol
7	contracts/Migrations.sol
8	contracts/test/Token.sol
9	coverage/contracts/TokenDrop.sol.html
10	coverage/lcov-report/contracts/TokenDrop.sol.html

PoolTogether security record

Issues (78)

Yearn: Re-entrancy attack during depositnot_fixed/critical

Yearn: Partial deposits are not processed properlynot_fixed/high

Sushi: balanceOfToken underestimates balancenot_fixed/medium

Sushi: redeemToken redeems less than it shouldnot_fixed/medium

Sushi: Some state variables should be immutable and have more specific typesnot_fixed/low

Audits (8)

Contracts (39)

Get your label

Audits (8)