PoolTogether security record
As of 29 Oct 2026, PoolTogether has 8 audit reports by 3 security firms on Trustblock; the latest is by Consensys, dated 1 May 2021. Those reports list 7 open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits8
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| PoolTogether — Sushi and Yearn V2 Yield Sources | Security firm: Consensys | Date: | Scope: Files named in the report | 1 open critical finding | Open · diligence.security |
| PoolTogether - Pods | Security firm: Consensys | Date: | Scope: Files named in the report | 4 open critical findings | Open · diligence.security |
| PoolTogether | Security firm: Consensys | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · diligence.security |
| PoolTogether - LootBox and MultipleWinners Strateg | Security firm: Consensys | Date: | Scope: Files named in the report | 2 open critical findings | Open · diligence.security |
| PoolTogether v3 Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| PoolTogether | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| PoolTogether Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Pool Together 2.0 | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings78
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 7 | 0 | 2 |
| High | 5 | 0 | 5 |
| Medium | 10 | 0 | 5 |
| Low | 25 | 0 | 19 |
CriticalYearn: Re-entrancy attack during depositPoolTogether — Sushi and Yearn V2 Yield Sources · Consensys · 1 May 2021Open
The report gives no description here.
Open the reportCriticalPod: Re-entrancy during deposit or withdrawal can lead to stealing fundsPoolTogether - Pods · Consensys · 1 Mar 2021Open
The report gives no description here.
Open the reportCriticalToken transfers may return falsePoolTogether - Pods · Consensys · 1 Mar 2021Open
The report gives no description here.
Open the reportCriticalTokenDrop: Unprotected initialize() functionPoolTogether - Pods · Consensys · 1 Mar 2021Open
The report gives no description here.
Open the reportCriticalWinning pods can be frontrun with large depositsPoolTogether - Pods · Consensys · 1 Mar 2021Open
The report gives no description here.
Open the reportCriticalLootBox - Unprotected selfdestruct in proxy implementationPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportCriticalPeriodicPrizeStrategy - RNG failure can lock user fundsPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportHighYearn: Partial deposits are not processed properlyPoolTogether — Sushi and Yearn V2 Yield Sources · Consensys · 1 May 2021Open
The report gives no description here.
Open the reportHighTokenDrop: Re-entrancy in the claim function can cause to draining fundsPoolTogether - Pods · Consensys · 1 Mar 2021Open
The report gives no description here.
Open the reportHighPeriodicPriceStrategy - trustedForwarder can impersonate any msg.senderPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportShow 10 more
HighTicket duplicationPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportHighUnpredictable behavior for users due to admin front running or general bad timingPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportMediumSushi: balanceOfToken underestimates balancePoolTogether — Sushi and Yearn V2 Yield Sources · Consensys · 1 May 2021Open
The report gives no description here.
Open the reportMediumSushi: redeemToken redeems less than it shouldPoolTogether — Sushi and Yearn V2 Yield Sources · Consensys · 1 May 2021Open
The report gives no description here.
Open the reportMediumPod: Fees are not limited by a user during the withdrawalPoolTogether - Pods · Consensys · 1 Mar 2021Open
The report gives no description here.
Open the reportMediumPod: Having multiple token drops is inconsistentPoolTogether - Pods · Consensys · 1 Mar 2021Open
The report gives no description here.
Open the reportMediumTokenFaucet refill can have an unexpected outcomePoolTogether · Consensys · 1 Feb 2021Open
The report gives no description here.
Open the reportMediumLootBox - plunder should disallow plundering to address(0)PoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportMediumMultipleWinners - setNumberOfWinners does not enforce count>0PoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportMediumPeriodicPriceStrategy - addExternalErc721Award duplicate or invalid tokenIds may block award phasePoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportShow 10 more
MediumPeriodicPrizeStrategy - Token with callback related warnings (ERC777 a.o.)PoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportMediumPeriodicPrizeStrategy - unbounded external tokens linked list may be used to force a gas DoSPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportLowSushi: Some state variables should be immutable and have more specific typesPoolTogether — Sushi and Yearn V2 Yield Sources · Consensys · 1 May 2021Open
The report gives no description here.
Open the reportLowSushi: Unnecessary balance queriesPoolTogether — Sushi and Yearn V2 Yield Sources · Consensys · 1 May 2021Open
The report gives no description here.
Open the reportLowSushi: Unnecessary function declaration in interfacePoolTogether — Sushi and Yearn V2 Yield Sources · Consensys · 1 May 2021Open
The report gives no description here.
Open the reportLowYearn: Redundant approve callPoolTogether — Sushi and Yearn V2 Yield Sources · Consensys · 1 May 2021Open
The report gives no description here.
Open the reportLowPod.setManager() checks validity of wrong addressPoolTogether - Pods · Consensys · 1 Mar 2021Open
The report gives no description here.
Open the reportLowProxyFactory.deployMinimal() does not check for contract creation failurePoolTogether - Pods · Consensys · 1 Mar 2021Open
The report gives no description here.
Open the reportLowRename Withdrawl event to WithdrawalPoolTogether - Pods · Consensys · 1 Mar 2021Open
The report gives no description here.
Open the reportLowGas Optimization on transfersPoolTogether · Consensys · 1 Feb 2021Open
The report gives no description here.
Open the reportShow 10 more
LowHandle transfer tokens where from == toPoolTogether · Consensys · 1 Feb 2021Open
The report gives no description here.
Open the reportLowRedundant/Duplicate checksPoolTogether · Consensys · 1 Feb 2021Open
The report gives no description here.
Open the reportLowCheck codesize before adding listenersPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportLowClean up unused source-units in the repositoryPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportLowInitialize implementations for proxy contracts and protect initialization methodsPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportLowLootBox - executeCalls can be misused to relay callsPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportLowLootBox - transferEther should be internalPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportLowLootBox - unnecessary payablePoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportLowMultipleWinners - Awards can be guaranteed with a set number of ticketsPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportLowMultipleWinners - Inconsistent behavior compared to SingleRandomWinnerPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportShow 7 more
LowPeriodicPrizeStrategy - Inconsistent behavior between award-phase modifiers and view functionsPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportLowReconsider the use of proxy factories in the system if they are not neededPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportLowRework the repository structure and clearly mark which 3rd party contracts have been modifiedPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportLowStick to clear interface naming conventionsPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportLowWhere possible, functions should accept a specific contract type rather than address parametersPoolTogether - LootBox and MultipleWinners Strateg · Consensys · 1 Nov 2020Open
The report gives no description here.
Open the reportLow[L01] Deviation from ERC777 specificationPoolTogether Audit · OpenZeppelin · 16 Jan 2020Open
The report gives no description here.
Open the reportLowCentralization of PowerPool Together 2.0 · Quantstamp · 4 Sep 2019Open
Smart contracts will often have an owner or admins to designate entities with special privileges to make modifications to the smart contract. Specifically, the pool admins have the privilege to commit and open draws, set fee fractions, set beneficiary of the fee, pause and unpause the contract, and add and remove admins. Consequently, if the last admin is ever removed, no new admin can ever be added. Exploit Scenario: Admins may take advantage of calling rewardAndOpenNextDraw() in the following scenarios: 1) Admins can try to wait until a favorable block to call rewardAndOpenNextDraw() since they control the entropy. 2) Admins can decide to never call rewardAndOpenNextDraw(), in which case the interest is locked forever. 3) Admins can delay calling rewardAndOpenNextDraw() for an extremely long period of time, waiting for most other users to exit so that the odds of winning the lottery are heavily in their favor.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="pooltogether"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us