Sky security record
As of 3 Nov 2026, Sky has 150 audit reports by 3 security firms on Trustblock; the latest is by ChainSecurity, dated 7 Sep 2026. Those reports list no open critical findings. It also holds 1 deployed contract on 1 chain.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits150
Newest first
150 audit reports, 77 in Cantina’s series, 68 in ChainSecurity’s series
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| usds | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| xchain-ssr-oracle | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| OP Farms Smart Contracts | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| snst (updates) | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| MakerDAO D3M AaveV3 USDS Pool | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| MakerDAO Op Farms Security Review | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| DSS Allocator | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| endgame lockstate (updates) | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Optimism Token Bridge | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| vote-delegate (updates) | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Allocator Deployment Scripts | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| univ2-pool-migrator (updates) | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| UniV2 Migration Deployment Scripts | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| MakerDAO USDS Wrappers | Security firm: ChainSecurity | Date: | Scope: Repository at commit 4056ade | No open critical findings | Open · chainsecurity.com |
| MakerDAO Arbitrum Farms | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| PSM Lite | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| nst upgrades | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| MakerDAO Vote Delegate Contract Audit | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| sdai snst | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| univ2-pool-migrator | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| dss-flappers | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| dss-lite-psm | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| D3M ERC4626 | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Direct Deposit V2 | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| dss-allocator | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
Findings204
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 6 |
| Medium | 2 | 5 | 17 |
| Low | 6 | 59 | 107 |
Medium`Dog` and `Clipper` could potentially have mismatched componentsAcknowledged
The `Dog` and `Clipper` contracts are designed to be components in a modular system that works together consistently to achieve certain functions. These contracts also interact with components other than `Dog` and `Clipper`, and it is expected that these components are the same from both `Dog` and `Clipper` perspectives. However, given that `vow` can set quite trivially via `file` in both contracts, without any validation, there is potential that `vow` may diverge and therefore lead to aberrant unexpected behaviors. At the same time, it was also mentioned in the code walk-through call that the `Clipper.dog` state variable which is currently `immutable` may lose that status in the future, and therefore even components like `vat` could potentially be mismatched and lead to larger issues.
MediumCure.cage() Might Block Shutdown ProcedureAcknowledged
The report gives no description here.
MediumProxy does not support payable functions in its implementationAcknowledged
The report gives no description here.
MediumRedemption Blocked When No Rate Entry at Maturity ExistsAcknowledged
The report gives no description here.
MediumStakingContract.setRewardsDuration can be DoS'dAcknowledged
The report gives no description here.
LowConfigure DVNs, peers, and pinned LayerZero librariesSky: Stars LZ Governance · Cantina · 4 Sep 2026Acknowledged
The report gives no description here.
Open the reportLowIssue Accounting and Rate Limit Are Not Bound to the Facility GemSky Diamond PAU v1. · ChainSecurity · 6 Jul 2026Acknowledged
The report gives no description here.
Open the reportLowNFAT position state can desync when repayments bypass facetSky: PAU NFAT Facet · Cantina · 6 Jul 2026Acknowledged
The report gives no description here.
Open the reportLowSome off-chain NFAT contracts may not be fully repayableSky: PAU NFAT Facet · Cantina · 6 Jul 2026Acknowledged
The report gives no description here.
Open the reportLowLayerZero confirmation guarantees for CCIP-backed DVNs reduce to Chainlink CCIP finality assumptionsSky: CCIP DVN Adapter · Cantina · 24 Jun 2026Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowRequire prefunding the CCIPDVNAdapterSky: CCIP DVN Adapter · Cantina · 24 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowSource-side CCIPDVNAdapter makes CCIP mandatory for every packet emissionSky: CCIP DVN Adapter · Cantina · 24 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowUse of deprecated EVMExtraArgsV1 for CCIP messagesSky: CCIP DVN Adapter · Cantina · 24 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowDeploy script does not check the beacon is empty before wiring itPAU: Diamond PAU Deployment Scripts & Deployment R · Cantina · 10 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowL2 Farm's reward rate might not be constantMakerDAO Op Farms Security Review · Cantina · 9 Sep 2024Acknowledged
The report gives no description here.
Open the reportLowlocking and freeing from LockstakeEngine can fail if ilk.dust increasesendgame lockstate (updates) · Cantina · 9 Sep 2024Acknowledged
The report gives no description here.
Open the reportLowUnchecked Return Value of transferFromPSM Lite · ChainSecurity · 4 Jul 2024Acknowledged
The report gives no description here.
Open the reportLowAround 20% of locks can be blocked statisticallyMakerDAO Vote Delegate Contract Audit · Cantina · 3 Jul 2024Acknowledged
The report gives no description here.
Open the reportLowFees can be trimmeddss-lite-psm · Cantina · 26 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowgush ignores total vat.Line() debt ceilingdss-lite-psm · Cantina · 26 Jun 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowTransferring gem out of pocket breaks PSMdss-lite-psm · Cantina · 26 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowTemporary DoS Due to Max Deposit in MetamorphoD3M ERC4626 · ChainSecurity · 21 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowAave Pool Size ManipulationDirect Deposit V2 · ChainSecurity · 20 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowDisable Plan Without EventDirect Deposit V2 · ChainSecurity · 20 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowend.skim() May Leave ink BehindDirect Deposit V2 · ChainSecurity · 20 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowImmutable InterestRateModelDirect Deposit V2 · ChainSecurity · 20 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowOptimization of auth ModifierDirect Deposit V2 · ChainSecurity · 20 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowThe AutoLine can be called immediately after initializationdss-allocator · Cantina · 24 Nov 2023Acknowledged
The report gives no description here.
Open the reportLowTwo separate auth systems can result in mistakesdss-allocator · Cantina · 24 Nov 2023Acknowledged
The report gives no description here.
Open the reportLowArbitrary delegatecall within the SubProxyAcknowledged
The report gives no description here.
Show 10 more
LowAuction parameters may change mid flightAcknowledged
There are several parameters in an auction that are deeply involved in tuning it, such as `cusp`, `tail`, `chip` or `tip`. In standard auctions, these parameters(or what they represent in terms of tuning) are usually set before the auction begins and held immutable until the end so that behaviour can be more predictable and fair to users and operators. However, it appears that in `Clipper`, all of these parameters can be mutated via `Clipper.file` at any time. This would mean that potentially an auction could be in flight and a subsequent parameter change in `file` abruptly stops the auction due to a `cusp` or `tail` decrement.
LowContracts may have no authorized wardAcknowledged
There is nothing preventing the single authorized address/user from calling `deny()` on themselves. This would cause the user to lock themselves out since they will no longer be able to call any function protected by the `auth` modifier in the smart contract.
LowCurrent diamond-pau changes that affect SparkAcknowledged
The report gives no description here.
LowCurveLib.swap minAmountOut check is less conservative due to additional truncationAcknowledged
The report gives no description here.
LowDifferent setup between devnet and mainnetAcknowledged
The report gives no description here.
LowGate1 Withdraw TimestampAcknowledged
The report gives no description here.
LowgetOrCreateProxy() or proxy[msg.sender]Acknowledged
The report gives no description here.
LowIncorrect initialization behaviorAcknowledged
1. [ACKNOWLEDGED] The specification indicates that the `Clipper.dog` should be authorized to call `kick`. However, the `Clipper.constructor` does not set `wards[dog] = 1`. 2. [MITIGATED] The `cut` in the `StairstepExponentialDecrease.constructor` is set to zero. This is not good, because it will lead to the `price` function returning zero. It is also not inline with the specification, which gives an example of `cut = 0.99 * RAY`.
LowInefficient _validateAcknowledged
The report gives no description here.
LowLeftover ClaimsAcknowledged
The report gives no description here.
Show 10 more
LowMismatches With Documentation and Lack ThereofAcknowledged
The report gives no description here.
LowMissing input validationAcknowledged
The majority of auth-ed functions do not have any input parameter validation in place, which could lead to unexpected values being set by authenticated accounts. The following list contains a few instances of such functions, however, the list is not exhaustive as it would be too long: 1. `Clipper.setBreaker` does not check the value of `level` and therefore the circuit breaker could be set to any unsigned integer value. In the current code, this is not a problem as the `isStopped` modifier uses the less-than (<) sign. However, it could be problematic if some service listens for `SetBreaker` events and it doesn’t expect any values other than 0, 1 and 2. 2. `Clipper.file` does not check if the value of the `data` parameter corresponding to each value of what is in the right range. For example, `buf` seems to always need to be higher than 100%, while `chip` and `cusp` should always be less than 100%. `tail` should always be greater than zero. 3. `Dog.file` does not check if the value of the `data` parameter corresponding to each value of what is in the right range. For example, `chop` should probably never be 0; `Hole` and `hole` should also never be zero. 4. `LinearDecrease.file` does not check if the value of the `data` parameter corresponding to each value of what is in the right range. For example, `tau` should always be greater than 0, otherwise the `price` function will throw due to a division-by-zero error. 5. `StairstepExponentialDecrease.file` does not check if the value of the `data` parameter corresponding to each value of what is in the right range. For example, `step` should always be greater than 0, otherwise the `price` function will throw due to a division-by-zero error. Also `cut` should always be greater than 0, otherwise the `price` function will return 0.
LowOracle delay may lead to `redo`-ing and bad debtAcknowledged
In `Clipper`, the auction sets the `top` price as a function of the OSM result. It is stated in the MIP45 specification that: > Note that the current OSM price is between one and two hours delayed relative to the actual market price. This means that there is a possibility that the actual market price could be sufficiently under the OSM price that the Keepers have no incentive `take`, therefore leading to incomplete auctions that `redo`. Every `redo` incentivizes callers with `tip` and `chip` which is funded from `vat`, thereby draining it slowly. Auctions which are incomplete for longer amounts of time run a higher risk of accumulating bad debt. Combined, they may cause a persistent overall value loss. The potential loss is scaled by the length of the OSM delay, since this plausible event is bounded by it. This issue was foreshadowed by [MIP45c21](https://forum.makerdao.com/t/mip45-liquidations-2-0-liq-2-0-liquidation-system-redesign/6352#MIP45c21) and [MIP45c23](https://forum.makerdao.com/t/mip45-liquidations-2-0-liq-2-0-liquidation-system-redesign/6352#MIP45c23) of the specification, and can be thought of as similar but not the same due to the focus on the oracle delay.
LowPossible Gas Optimization for MappingsAcknowledged
The report gives no description here.
LowPossible OptimizationsAcknowledged
The report gives no description here.
LowPrecision Loss in rewardRate CalculationAcknowledged
The report gives no description here.
LowPrivileged Roles and OwnershipAcknowledged
Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. In these contracts we have a homemade authentication system that guards key functions such as `file`, `cage`, `yank` or `setBreaker`. Whilst it is understood these contracts are designed with a multilateral governance system in mind for the privileged role, it is important to note the potential impact.
LowRate and urnImplementation Not ValidatedAcknowledged
The report gives no description here.
LowRate-limit accounting is inconsistent across request/cancel and unwind flowsAcknowledged
The report gives no description here.
LowRedundant External CallsAcknowledged
The report gives no description here.
Show 10 more
LowRestrict Configurator updates to BeamState-defined rate-limit keysAcknowledged
The report gives no description here.
LowReward tokens can be retrieved from StakingContractAcknowledged
The report gives no description here.
LowSkip Calls When No Additional Debt Is NeededAcknowledged
The report gives no description here.
LowSlice at Timestamp With No RateAcknowledged
The report gives no description here.
LowSolana ⇔ EVM rate limiter differencesAcknowledged
The report gives no description here.
LowSolidity rounding dust can accumulate in the StakingRewardsAcknowledged
The report gives no description here.
LowStaking rewards are not distributed linearlyAcknowledged
The report gives no description here.
LowThe implementation must be trustedAcknowledged
The report gives no description here.
LowThe rewards will be lost between first notifyRewardAmount and first stakeAcknowledged
The report gives no description here.
LowTips may not be enough to cover gas fees when network is congestedAcknowledged
The purpose of the `tip` state variable is to incentivize keepers to call `bark` such that they would be reimbursed for the gas fee. However, since this is a flat fee, it may not cover the gas costs when the network is highly congested and the gas prices are high.
Show 4 more
LowUncallable functions on implementation contractAcknowledged
The report gives no description here.
LowUniswapV3 removeLiquidity requires an active withdraw limit even for the zero-output sideAcknowledged
The report gives no description here.
LowUnlocked PragmaAcknowledged
Every Solidity file scoped specifies in the header a version number of the format `pragma solidity >=0.6.11`. The greater-or-equal (`>=`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked".
LowUnnecessary Additional TransfersAcknowledged
The report gives no description here.
Contracts1
| Address | Chain | Source code |
|---|---|---|
| 0xdc035d45d973e3ec169d2276ddab16f1e407384f | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="sky"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us