RAI Finance security record
As of 3 Nov 2026, RAI Finance has 1 audit report on Trustblock, by CertiK, dated 26 Oct 2022. That report lists 1 critical acknowledged and not fixed.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| RAI Finance | Security firm: CertiK | Date: | Scope: Files named in the report | 1 critical acknowledged, not fixed | Open · skynet.certik.com |
Findings12
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 0 |
| High | 3 | 0 | 2 |
| Medium | 0 | 1 | 1 |
| Low | 0 | 0 | 4 |
High`_receiveToken` Should Be In `PortfolioFactory.isRAI Finance · CertiK · 26 Oct 2022Fixed
The `_portfolio` manager calls the function `trade` to swap `_sendToken` to `_receiveToken`, `_sendToken` has been checked when creating `portfolio`, but `_receiveToken` is not checked, `manager` can swap to any token, it's unsafe.
Open the reportHighCentralization Risk in SimpleERC20.solRAI Finance · CertiK · 26 Oct 2022Fixed
In the contract, `SimpleERC20`, the role, `_owner`, has the authority over the functions shown in the diagram below. Any compromise to the privileged account which has access to `_owner` may allow the hacker to take advantage of this. 
Open the reportMedium`positionMultiplier` Should Not Be UpdatedRAI Finance · CertiK · 26 Oct 2022Fixed
`onlyModule` can call `editPositionMultiplier` to update `positionMultiplier`, if `Portfolio.totalSupply()` is not zero, minted tokens don't keep consistent with components assets when `positionMultiplier` is modified. So it's unsafe to update `positionMultiplier`.
Open the reportLowCheck `amountEthOut` Instead Of `totalEth`RAI Finance · CertiK · 26 Oct 2022Fixed
In the function `sellExactPortfolioForETH`, `totalEth` is a evaluation value, which can be manipulated by attackers, check `totalEth > _minEthOut` is not safe.
Open the reportLowMissing `_router` ValidationRAI Finance · CertiK · 26 Oct 2022Fixed
`isRouter` is maintained in the contract but not used in `tradeXXX` functions.
Open the reportLowMissing Module ImplementationRAI Finance · CertiK · 26 Oct 2022Fixed
These functions implemented, but the module to call these functions are not implemented. -addExternalPositionModule -removeExternalPositionModule -editExternalPositionUnit -editExternalPositionData -editPositionMultiplier -lock -unlock
Open the reportLowRedundant calling `onlyValidAndInitializedPortfolRAI Finance · CertiK · 26 Oct 2022Fixed
When users call the function `issue`, it calls `onlyValidAndInitializedPortfolio` twice, it's better to optimise it as following. ```=js function getRequiredComponentUnitsForIssue( IPortfolio _portfolio, uint256 _quantity ) public view onlyValidAndInitializedPortfolio(_portfolio) returns (address[] memory, uint256[] memory) { return _getRequiredComponentUnitsForIssue(_portfolio, _quantity); } function _getRequiredComponentUnitsForIssue( IPortfolio _portfolio, uint256 _quantity ) internal view returns (address[] memory, uint256[] memory) { address[] memory components = _portfolio.getComponents(); uint256[] memory notionalUnits = new uint256[](components.length); for (uint256 i = 0; i < components.length; i++) { require(!_portfolio.hasExternalPosition(components[i]), "Only default positions are supported"); notionalUnits[i] = _portfolio.getDefaultPositionRealUnit(components[i]).toUint256().preciseMulCeil(_quantity); } return (components, notionalUnits); } ```
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="rai-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us