As of 3 Nov 2026, ShadowFi has 2 audit reports by 2 security firms on Trustblock; the latest is by Cyberscope, dated 20 May 2024. Those reports list 2 open critical findings. It also holds 1 deployed contract on 1 chain.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| ShadowGold | Security firm: Cyberscope | Date: | Scope: 1 address on Polygon (POS) | 2 open critical findings | Open · cyberscope.io |
| Shadowfi | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 2 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 2 | 0 | 0 |
| Low | 28 | 0 | 8 |
In the Contract `[ShadowFi.sol]`, when the function `addLiquidity` is called, the `autoLiquidityReceiver` will receive the LP tokens. In the contract `[ShadowFi.sol]`, the role `[onlyOwner]` has authority over the following functions: - `setGasPriceLimit()` - allows the Owner to set the Gwei to X to combat sniping in early blocks. - `enableGasLimit()` - enables anti-sniping measures. - `airdrop()` - airdrops token to users. - `setBlackListed()` - blacklists an address from the system. - `setAuthorized()` - sets an address to gain a centralized role. - `transferOwnership()` - transfers the ownership of the contract. - `withdrawBNB()` - take BNB stuck in contract. In the contract `[ShadowFi.sol]`, the role `[forAuthorize]` has authority over the following functions: - `authorizeFor()` - Sets an address to be allowed to use a certain permissioned function. - `authorizeForMultiplePermissions()` Allows an address to be given access to multiple permissioned functions. - `unauthorizeFor()` - Removes permissions from an address. - `lockPermission()` - Locks the permission from being used for X time. - `unlockPermission()` - Unlocks the permission after locking has passed. - `triggerBuyback()` - Triggers purchase and sends them to zero address. - `clearBuybackMultiplier()` - Sets the multiplier to zero. - `setBuybackMultiplierSettings()` - Sets the inputs to a certain amount for buy backs. - `setTxLimit()` - Sets the transaction limit to a max amount. In the contract `[ShadowFi.sol]`, the role `[authorized]` has authority over the following functions: - `setBuybackMultiplierSettings()` - Sets the multiplier settings. - `setIsFeeExempt()` - Sets addresses to be exempt from fees. - `setIsDividendExempt()` - Sets addresses to be exempt from dividends. Any compromise to the `[onlyOwner]`, `[authorizedFor]`, and `[onlyToken]` accounts inside of `[ShadowFi.sol]` may allow a hacker to take advantage of this authority. In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this.  In the contract `ShadowFiLiquidityLock` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this. 
Open the report| Address | Chain | Source code |
|---|---|---|
| 0x8bc3…60fe0x8bc3ec2e7973e64be582a90b08cadd13457160fe | Chain: Polygon (POS) | Source code: Verified source |
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="shadowgold"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us