PoolTogether security record
As of 30 Oct 2026, PoolTogether has 8 audit reports by 3 security firms on Trustblock; the latest is by Consensys, dated 1 May 2021. Those reports list 7 open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits8
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| PoolTogether — Sushi and Yearn V2 Yield Sources | Security firm: Consensys | Date: | Scope: Files named in the report | 1 open critical finding | Open · diligence.security |
| PoolTogether - Pods | Security firm: Consensys | Date: | Scope: Files named in the report | 4 open critical findings | Open · diligence.security |
| PoolTogether | Security firm: Consensys | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · diligence.security |
| PoolTogether - LootBox and MultipleWinners Strateg | Security firm: Consensys | Date: | Scope: Files named in the report | 2 open critical findings | Open · diligence.security |
| PoolTogether v3 Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| PoolTogether | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| PoolTogether Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Pool Together 2.0 | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings78
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 7 | 0 | 2 |
| High | 5 | 0 | 5 |
| Medium | 10 | 0 | 5 |
| Low | 25 | 0 | 19 |
Critical[C01] Funds can be lostPoolTogether v3 Audit · OpenZeppelin · 21 Oct 2020Fixed
The report gives no description here.
Open the reportCritical[C01] Supply is manipulablePoolTogether · OpenZeppelin · 21 Apr 2020Fixed
The report gives no description here.
Open the reportHigh[H01] Improper Error HandlingPoolTogether v3 Audit · OpenZeppelin · 21 Oct 2020Fixed
The report gives no description here.
Open the reportHigh[H02] Trapped sponsorshipPoolTogether v3 Audit · OpenZeppelin · 21 Oct 2020Fixed
The report gives no description here.
Open the reportHigh[H01] Deposit uses operator collateralPoolTogether · OpenZeppelin · 21 Apr 2020Fixed
The report gives no description here.
Open the reportHigh[H01] Users can influence the lottery winnerPoolTogether Audit · OpenZeppelin · 16 Jan 2020Fixed
The report gives no description here.
Open the reportHigh[H02] Winners can stall the systemPoolTogether Audit · OpenZeppelin · 16 Jan 2020Fixed
The report gives no description here.
Open the reportMedium[M01] Capturing the award balance may failPoolTogether v3 Audit · OpenZeppelin · 21 Oct 2020Fixed
The report gives no description here.
Open the reportMedium[M01] Inconsistent list initializationPoolTogether v3 Audit · OpenZeppelin · 21 Oct 2020Fixed
The report gives no description here.
Open the reportMedium[M01] Incomplete ERC777 functionalityPoolTogether · OpenZeppelin · 21 Apr 2020Fixed
The report gives no description here.
Open the reportShow 10 more
Medium[M01] Double counting rewardsPoolTogether Audit · OpenZeppelin · 16 Jan 2020Fixed
The report gives no description here.
Open the reportMedium[M02] Bypassing token eventsPoolTogether Audit · OpenZeppelin · 16 Jan 2020Fixed
The report gives no description here.
Open the reportLowUnnecessary use of upgradability ✓PoolTogether · Consensys · 1 Feb 2021Fixed
The report gives no description here.
Open the reportLow[L01] Duplicate codePoolTogether v3 Audit · OpenZeppelin · 21 Oct 2020Fixed
The report gives no description here.
Open the reportLow[L01] Missing docstringsPoolTogether v3 Audit · OpenZeppelin · 21 Oct 2020Fixed
The report gives no description here.
Open the reportLow[L02] Linked list contains SENTINALPoolTogether v3 Audit · OpenZeppelin · 21 Oct 2020Fixed
The report gives no description here.
Open the reportLow[L02] Tests not passingPoolTogether v3 Audit · OpenZeppelin · 21 Oct 2020Fixed
The report gives no description here.
Open the reportLow[L03] Lists can be initialized multiple timesPoolTogether v3 Audit · OpenZeppelin · 21 Oct 2020Fixed
The report gives no description here.
Open the reportLow[L04] Lack of event emission after sensitive changesPoolTogether v3 Audit · OpenZeppelin · 21 Oct 2020Fixed
The report gives no description here.
Open the reportLow[L05] MappedSinglyLinkedList EncapsulationPoolTogether v3 Audit · OpenZeppelin · 21 Oct 2020Fixed
The report gives no description here.
Open the reportShow 10 more
Low[L06] Naming suggestionsPoolTogether v3 Audit · OpenZeppelin · 21 Oct 2020Fixed
The report gives no description here.
Open the reportLow[L01] Missing return valuePoolTogether · OpenZeppelin · 21 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L02] Misleading commentsPoolTogether · OpenZeppelin · 21 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L03] Complicated CodePoolTogether · OpenZeppelin · 21 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L02] Only direct deposits are pausablePoolTogether Audit · OpenZeppelin · 16 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L03] Double spending ERC20 allowancePoolTogether Audit · OpenZeppelin · 16 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L04] Unexpected Side EffectsPoolTogether Audit · OpenZeppelin · 16 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L05] Conflated balancesPoolTogether Audit · OpenZeppelin · 16 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L06] Misleading comments and variable namesPoolTogether Audit · OpenZeppelin · 16 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L07] Excessive code couplingPoolTogether Audit · OpenZeppelin · 16 Jan 2020Fixed
The report gives no description here.
Open the reportShow 1 more
Low[L08] Unchecked casting from uint256 to int256PoolTogether Audit · OpenZeppelin · 16 Jan 2020Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="pooltogether"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us