Slingshot security record
As of 30 Oct 2026, Slingshot has 2 audit reports by 1 security firm on Trustblock; the latest is by Paladin, dated 28 Dec 2024. Those reports list no open critical findings. It also holds 82 deployed contracts on 2 chains.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Slingshot (Arbitrum) | Security firm: Paladin | Date: | Scope: 44 addresses on Polygon (POS) and Arbitrum | No open critical findings | Open · paladinsec.co |
| Audit Report | Security firm: Paladin | Date: | Scope: 38 addresses on Polygon (POS) and Arbitrum | No open critical findings | Open · paladinsec.co |
Findings54
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 2 |
| Medium | 1 | 1 | 3 |
| Low | 6 | 7 | 33 |
HighcreateLockFor lacks sufficient safeguards allowing an exploiter to drain any approved governance tokens from any walletAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportHighideaSet logic is significantly flawed and will cause all votes to eventually always revertAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportMedium_updateRewardAmount allocates too much funds to future periodsAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportMediumclaim() will frequently revert as claimRewardForEpochs() will fail at claiming rewards for an active epochAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportMediumpause does not correctly update the stored epoch within the epochs list, causing this list to potentially become outdatedAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLow_claimRewardForEpoch does not internally check against double claimingAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLow_updateRewardAmount can revert starting from epoch 52Audit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowclaim might start to revert implicitly if the vestingPeriod is ever lengthenedAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowCompleteness: Codebase does not handle return values of ERC20 transfersAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowfeeToken can be made immutableAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowGas optimizationAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowgetIdeaInfo and getProposalFee can be made externalAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowIdentical ideas can be published multiple timesAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowImplicit super calls when multiple parent contracts implement the function might be confusing to reviewersAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowLack of validationAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowMINTIME validation should occur after the unlock_time is rounded downAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowNot all user functions are protected with a reentrancy guardAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowrunwayLength can be made constantAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowset_smart_wallet_checker ERC-165 check is insufficientAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowStyle: Inconsistent usage of require and if/revert patternsAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowStyle: publishIdea does not adhere to checks-effects-interactionsAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowStyle: Usage of address type for contracts with an actual interfaceAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowThe ideator of the idea with ID = 1 is set to a non-zero accountAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowtoken and veContract can be made immutableAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowtoken can be made immutableAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowtoken can be made immutableAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowtoken can be made immutableAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowtoken can be made immutableAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowtreasury can be made immutableAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowTypographical errorAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportShow 8 more
LowTypographical errorAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowTypographical errorsAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowUnused components: _getThisEpoch, ReentrancyGuard.sol, veContractAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowUnused import: IEpochManager.solAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowUsers might pay an unexpectedly high fee if governance changes the proposal fee while their transaction is pendingAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportLowvotingPowerThreshold lacks proper validationAudit Report · Paladin · 17 Apr 2023Fixed
The report gives no description here.
Open the reportContracts82
| Address | Chain | Source code |
|---|---|---|
| 0xf5dea604b100ca012c395ca00e731429e11001d3 | Chain: Polygon (POS) | Source code: Verified source |
| 0x0a574171411bbfc21d2bbfdba324f6bbb3374ec4 | Chain: Arbitrum | Source code: Verified source |
| 0xf39d5825207e5464221eb65100ef1a6434ceef3d | Chain: Arbitrum | Source code: Verified source. Powered by Etherscan.io APIs |
| 0x5364ec7fb4ddfe662009c4b6e2668d5a8a61d658 | Chain: Polygon (POS) | Source code: Verified source |
| 0x875b2b5f1b83b50e0215fe7bb84e750b637b64d8 | Chain: Arbitrum | Source code: Verified source |
| 0xc23727dfea6c9ac55e8df6c40f779e0caf49324e | Chain: Arbitrum | Source code: Verified source |
| 0xad9b49024c62be0c7f16a4aeac35077f1ce85210 | Chain: Polygon (POS) | Source code: Verified source |
| 0x6dbea2463fdf3da7a53e87e774ac8db414529a31 | Chain: Polygon (POS) | Source code: Verified source |
| 0x20491b614c25ab7d0715fdfe566303b241b67097 | Chain: Arbitrum | Source code: Verified source |
| 0xd2bda552055728e38acabe961af82a866adaf548 | Chain: Polygon (POS) | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="slingshot-app"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us