Sky security record
As of 3 Nov 2026, Sky has 150 audit reports by 3 security firms on Trustblock; the latest is by ChainSecurity, dated 7 Sep 2026. Those reports list no open critical findings. It also holds 1 deployed contract on 1 chain.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits150
Newest first
150 audit reports, 77 in Cantina’s series, 68 in ChainSecurity’s series
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| endgametoolkit | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| erc20-helpers upgradeable-proxy | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| nst | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| dss-conduits | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| ngt | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| ArrangerConduit | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| FlapperUniV2SwapOnly | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| RWA Toolkit | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| FlapperUniV2 | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| zkSync DAI Bridge (not deployed) | Security firm: ChainSecurity | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · chainsecurity.com |
| GemJoin9 for PAXG | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| G UNI LP Oracle | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| Starknet Teleport | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| DSSProxyActions | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| DSS Proxy | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| Claim Fee | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| DSS Cure | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| DAI Teleport Bridge | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| DSS Crop Join | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Curve LP & stETH oracle | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| CDP registry | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| Direct Deposit Module (D3M) | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| DSS Charter | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Optimism DAI Bridge | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| MakerDAO Liquidations 2.0 | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings204
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 6 |
| Medium | 2 | 5 | 17 |
| Low | 6 | 59 | 107 |
CriticalOutdated InterfaceszkSync DAI Bridge (not deployed) · ChainSecurity · 20 Mar 2023Fixed
The report gives no description here.
Open the reportCriticalArbitrary Call in lzReceiveFixed
The report gives no description here.
HighIncreasing VAT Debt After Shutdown, After thaw()Claim Fee · ChainSecurity · 12 May 2022Fixed
The report gives no description here.
Open the reportHighFees May Block Slow PathDAI Teleport Bridge · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportHighDSPC.set can bypass the cfg.step constraint by including the same id multiple times in the updates array and continuously increase the bpsFixed
The report gives no description here.
HighStakingRewards rewardsDistribution Ownership InconsistencyFixed
The report gives no description here.
HighVest Minting Not PossibleFixed
The report gives no description here.
HighVest Ownership Not Transferred at DeploymentFixed
The report gives no description here.
MediumUnpermissioned Access to onlyMate MethodsRWA Toolkit · ChainSecurity · 6 Jul 2023Fixed
The report gives no description here.
Open the reportMediumCritical Tests MissingzkSync DAI Bridge (not deployed) · ChainSecurity · 20 Mar 2023Fixed
The report gives no description here.
Open the reportShow 10 more
MediumRefund Recipient Is Not AliasedzkSync DAI Bridge (not deployed) · ChainSecurity · 20 Mar 2023Fixed
The report gives no description here.
Open the reportMediumMissing DocumentationG UNI LP Oracle · ChainSecurity · 17 Nov 2022Fixed
The report gives no description here.
Open the reportMediumfile() Has No Access ControlStarknet Teleport · ChainSecurity · 21 Jun 2022Fixed
The report gives no description here.
Open the reportMediumfinalize_register_teleport() Only Possible When OpenStarknet Teleport · ChainSecurity · 21 Jun 2022Fixed
The report gives no description here.
Open the reportMediumComments Regarding vow.heal()Claim Fee · ChainSecurity · 12 May 2022Fixed
The report gives no description here.
Open the reportMediumGate1.heal()Claim Fee · ChainSecurity · 12 May 2022Fixed
The report gives no description here.
Open the reportMediumGovernance Can Burn From UsersClaim Fee · ChainSecurity · 12 May 2022Fixed
The report gives no description here.
Open the reportMediumtotalSupply Mapping Not UpdatedClaim Fee · ChainSecurity · 12 May 2022Fixed
The report gives no description here.
Open the reportMediumL2 AddressesDAI Teleport Bridge · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportMediumMinting Pending DAI Incurs Additional FeesDAI Teleport Bridge · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportShow 10 more
MediumPossible Revert Due to UnderflowDSS Charter · ChainSecurity · 17 Nov 2021Fixed
The report gives no description here.
Open the reportMediumCurrent diamond-pau changes that affect GroveFixed
The report gives no description here.
MediumIncorrect newMintAuthority in the payload to migrate the USDS mint authority on Solana from NTT to OFTFixed
The report gives no description here.
MediumUnclaimable or Leftover PoolShares During Global SettlementFixed
The report gives no description here.
MediumUniswapV3 removeLiquidity can DoS when accrued fees are large relative to removed principalFixed
The report gives no description here.
LowIncomplete ILayerZeroReceiver Interface ImplementationSky xchain-helpers · ChainSecurity · 21 Aug 2026Fixed
The report gives no description here.
Open the reportLowIncorrect Amount Passed in quote_sendSky OApp OFT · ChainSecurity · 21 Aug 2026Fixed
The report gives no description here.
Open the reportLowUnable to Receive Transfers to address(0) or Token Contract AddressSky OApp OFT · ChainSecurity · 21 Aug 2026Fixed
The report gives no description here.
Open the reportLowFlipperMom Missing in ChainlogSky DSS Exec Lib · ChainSecurity · 12 Jun 2026Fixed
The report gives no description here.
Open the reportLowERC-20 Missing Return ValueArrangerConduit · ChainSecurity · 30 Oct 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowFloating PragmaArrangerConduit · ChainSecurity · 30 Oct 2023Fixed
The report gives no description here.
Open the reportLowUse of Unsafe Math Subject to OverflowsRWA Toolkit · ChainSecurity · 6 Jul 2023Fixed
The report gives no description here.
Open the reportLowPull DAI From Vow All at OnceFlapperUniV2 · ChainSecurity · 6 Jun 2023Fixed
The report gives no description here.
Open the reportLowInconsistent Use of InterfaceszkSync DAI Bridge (not deployed) · ChainSecurity · 20 Mar 2023Fixed
The report gives no description here.
Open the reportLowLack of DocumentationzkSync DAI Bridge (not deployed) · ChainSecurity · 20 Mar 2023Fixed
The report gives no description here.
Open the reportLowRemaining TODO in the Source CodezkSync DAI Bridge (not deployed) · ChainSecurity · 20 Mar 2023Fixed
The report gives no description here.
Open the reportLowUnused enumzkSync DAI Bridge (not deployed) · ChainSecurity · 20 Mar 2023Fixed
The report gives no description here.
Open the reportLowTokens With More Than 18 Decimals Not Caught in ConstructorGemJoin9 for PAXG · ChainSecurity · 10 Jan 2023Fixed
The report gives no description here.
Open the reportLowUnused Constant VariableG UNI LP Oracle · ChainSecurity · 17 Nov 2022Fixed
The report gives no description here.
Open the reportLowNo Event for finalize_teleport()Starknet Teleport · ChainSecurity · 21 Jun 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowUnused CodeStarknet Teleport · ChainSecurity · 21 Jun 2022Fixed
The report gives no description here.
Open the reportLowSkim in _Free()DSSProxyActions · ChainSecurity · 12 Jun 2022Fixed
The report gives no description here.
Open the reportLowUnused Function _sub()DSSProxyActions · ChainSecurity · 12 Jun 2022Fixed
The report gives no description here.
Open the reportLowUse Defined ConstantDSSProxyActions · ChainSecurity · 12 Jun 2022Fixed
The report gives no description here.
Open the reportLowDssProxy Constructor Does Not Emit SetOwner EventDSS Proxy · ChainSecurity · 10 Jun 2022Fixed
The report gives no description here.
Open the reportLowOptimization of delegatecall Success CheckDSS Proxy · ChainSecurity · 10 Jun 2022Fixed
The report gives no description here.
Open the reportLowPossible Failure of create2DSS Proxy · ChainSecurity · 10 Jun 2022Fixed
The report gives no description here.
Open the reportLowPossible Optimization in Proxy Check of RegistryDSS Proxy · ChainSecurity · 10 Jun 2022Fixed
The report gives no description here.
Open the reportLowAddress of VOWClaim Fee · ChainSecurity · 12 May 2022Fixed
The report gives no description here.
Open the reportLowDuplicate CheckClaim Fee · ChainSecurity · 12 May 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowMaturity in the PastClaim Fee · ChainSecurity · 12 May 2022Fixed
The report gives no description here.
Open the reportLowthis Keyword in initializeIlkClaim Fee · ChainSecurity · 12 May 2022Fixed
The report gives no description here.
Open the reportLowUnused Constants and FunctionClaim Fee · ChainSecurity · 12 May 2022Fixed
The report gives no description here.
Open the reportLowVarious Event IssuesClaim Fee · ChainSecurity · 12 May 2022Fixed
The report gives no description here.
Open the reportLowCode InefficiencyDAI Teleport Bridge · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportLowfile() Casting Bytes32 to Uint256DAI Teleport Bridge · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportLowInterface MismatchDAI Teleport Bridge · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportLowMissing IndexDAI Teleport Bridge · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportLowMissing or Incomplete NatspecDAI Teleport Bridge · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportLowSpecification MismatchDAI Teleport Bridge · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowCurve RegistryCurve LP & stETH oracle · ChainSecurity · 1 Mar 2022Fixed
The report gives no description here.
Open the reportLowDocumentation Not up to DateDSS Crop Join · ChainSecurity · 1 Mar 2022Fixed
The report gives no description here.
Open the reportLowEvent Fields ConsistencyDSS Crop Join · ChainSecurity · 1 Mar 2022Fixed
The report gives no description here.
Open the reportLowIncorrect Decimal AnnotationDSS Crop Join · ChainSecurity · 1 Mar 2022Fixed
The report gives no description here.
Open the reportLowNewProxy Event ConsistencyDSS Crop Join · ChainSecurity · 1 Mar 2022Fixed
The report gives no description here.
Open the reportLowOutdated Compiler VersionCurve LP & stETH oracle · ChainSecurity · 1 Mar 2022Fixed
The report gives no description here.
Open the reportLowPotential InconsistencyCurve LP & stETH oracle · ChainSecurity · 1 Mar 2022Fixed
The report gives no description here.
Open the reportLowUrn Proxy Load InefficiencyDSS Crop Join · ChainSecurity · 1 Mar 2022Fixed
The report gives no description here.
Open the reportLowInconsistent Retrieval of Ilk ParameterDSS Charter · ChainSecurity · 17 Nov 2021Fixed
The report gives no description here.
Open the reportLowink Used as daiDebtDirect Deposit Module (D3M) · ChainSecurity · 17 Nov 2021Fixed
The report gives no description here.
Open the reportShow 10 more
LowPossible Optimization on Getting vat AddressDSS Charter · ChainSecurity · 17 Nov 2021Fixed
The report gives no description here.
Open the reportLowUnused Function _toRad()DSS Charter · ChainSecurity · 17 Nov 2021Fixed
The report gives no description here.
Open the reportLowBurn Function Redundant ChecksOptimism DAI Bridge · ChainSecurity · 29 Jul 2021Fixed
The report gives no description here.
Open the reportLowContract L2GovernanceRelay Unnecessary StatefulnessOptimism DAI Bridge · ChainSecurity · 29 Jul 2021Fixed
The report gives no description here.
Open the reportLowInit Function of L2GovernanceRelayOptimism DAI Bridge · ChainSecurity · 29 Jul 2021Fixed
The report gives no description here.
Open the reportLowAuction may halt if peek is zeroMakerDAO Liquidations 2.0 · Quantstamp · 25 Feb 2021Fixed
There is no check that enforces the price returned by `pip.peek()` be greater than zero inside `Clipper.kick` and `Clipper.redo`. This would lead to setting the `top` value of an auction to zero, which is probably not desired. Having `top == 0` would cause a revert in the `rdiv(price, top)` inside the `Clipper.status` function, which would block access to calling `Clipper.redo` and `Clipper.take` again for `tail` amount of seconds.
Open the reportLowDivision by zeroMakerDAO Liquidations 2.0 · Quantstamp · 25 Feb 2021Fixed
There is a primitive division operation inside the `bark` function which could lead to a “division by zero” error, because the divisor is not checked to be greater than zero, i.e. the 2nd division on L174: `dart = min(art, mul(room, WAD) / rate / milk.chop);` where `milk.chop` could be zero if set by the `Dog.file` function.
Open the reportLowAave V3 Reward Claiming FailureFixed
The report gives no description here.
LowActors can self-call the agent to escalate rolesFixed
The report gives no description here.
LowBypassing Step-SizeFixed
The report gives no description here.
Show 10 more
LowCCTPLib hardcoded MAX_FEE = 0 has no on-chain update pathFixed
The report gives no description here.
LowDangling ApprovalFixed
The report gives no description here.
LowDiscrepancy in the Handling of Unachievable Target Interest RatesFixed
The report gives no description here.
LowDoSing Ilk InitializationsFixed
The report gives no description here.
LowDouble count of balance in the offchain events in the Kamino syncFixed
The report gives no description here.
LowDrift integration state.balance should update to the current lending balanceFixed
The report gives no description here.
LowDrift withdrawal is not updating state.balance resulting in double-counted sync eventsFixed
The report gives no description here.
LowDSPC could lead to undesirable configuration of ratesFixed
The report gives no description here.
LowImpossibility to Create One-Side Token1 LiquidityFixed
The report gives no description here.
LowInaccurate SpecificationFixed
The report gives no description here.
Show 10 more
LowInconsistent Wards Safety CheckFixed
The report gives no description here.
LowIncorrect Ilk ClassFixed
The report gives no description here.
LowIncorrect SpecificationFixed
The report gives no description here.
LowIncorrect Uniswap V3 Path InterpretationFixed
The report gives no description here.
LowIncorrect Use of try/catchFixed
The report gives no description here.
Lowinit_governance Can Be DoSedFixed
The report gives no description here.
LowInitialization Does Not Check DivisorFixed
The report gives no description here.
LowInitialize default BeamState.maxChange to 100% to unblock rate-limit decreasesFixed
The report gives no description here.
LowInsufficient Conditions for active() PlanFixed
The report gives no description here.
LowLayerZeroLib: no refund for overpaid nativeFee in ETHFixed
The report gives no description here.
Show 10 more
LowLockstakeInit.updateClipper is missing stUSDS.rely(clipper)Fixed
The report gives no description here.
LowMetadata Update Authority is left to the old WH governance PDAFixed
The report gives no description here.
LowMigration test run on Solana devnet upgraded the NTTManager to an incorrect older versionFixed
The report gives no description here.
LowMinor issues, Typos & DocumentationFixed
The report gives no description here.
LowMissing authority change check in wh-program-upgrade and wrong spill accountFixed
The report gives no description here.
LowMissing Check for BumpFixed
The report gives no description here.
LowMissing Check of Reward Token on Farm ContractFixed
The report gives no description here.
LowMissing ChecksFixed
The report gives no description here.
LowMissing ChecksFixed
The report gives no description here.
LowMissing reserve checks results in bogus sync events on DriftFixed
The report gives no description here.
Show 10 more
LowNo EventsFixed
The report gives no description here.
LowNo NatspecFixed
The report gives no description here.
LowNo Vat line Check for Line WipesFixed
The report gives no description here.
LowPhase 2 Might Not Migrate GemFixed
The report gives no description here.
Lowrate and rate constraints can be set for non-existing ilk in jugFixed
The report gives no description here.
LowRate Is Not ValidatedFixed
The report gives no description here.
LowReadme Is Outdated About Wards of NSTFixed
The report gives no description here.
LowRent is lost in the controller_authority when Kamino Obligation is closedFixed
The report gives no description here.
LowScripts payload output should be in hex format to allow exact validationFixed
The report gives no description here.
LowSetting new NSR breaks reliability of extrapolating view functionsFixed
The report gives no description here.
Show 10 more
LowSplitter.cage() Does Not Lock the SplitterFixed
The report gives no description here.
LowStUsdsWipeParamSpell.done() can report line wipe completion before the effective Vat line is zeroFixed
The report gives no description here.
LowSubProxy rely() to MCD End Instead of MCD ESM During InitializationFixed
The report gives no description here.
LowSwapperCalleeUniV3 is incompatible with USDTFixed
The report gives no description here.
Lowsync_drift_balance() is reading stale cumulative_deposit_interest and emitting inaccurate interest valuesFixed
The report gives no description here.
LowThe withdraw function can withdraw less than lotFixed
The report gives no description here.
LowUninitialized Vow in DssLitePsmInitFixed
The report gives no description here.
LowUniswap V3 and Uniswap V4 asymmetriesFixed
The report gives no description here.
LowUnlimited-to-finite rate-limit transition reverts due overflow, blocking decreasesFixed
The report gives no description here.
LowUnwind Collects Interest, Fails to Reach Target Interest RateFixed
The report gives no description here.
Show 2 more
LowVest Should Not Have a Cliff PeriodFixed
The report gives no description here.
LowWrong Chainlog IdentifiersFixed
The report gives no description here.
Contracts1
| Address | Chain | Source code |
|---|---|---|
| 0xdc035d45d973e3ec169d2276ddab16f1e407384f | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="sky"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us