Spark security record
As of 30 Oct 2026, Spark has 32 audit reports by 2 security firms on Trustblock; the latest is by Cantina, dated 14 Aug 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits32
Newest first
32 audit reports, 10 in ChainSecurity’s series
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| SparkDAO Governance Relay | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Kill Switch | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Core Updates to SparkLend | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| SparkLend Freezer | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| sparklend-conduits | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| SparkLendConduit | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Interest Rate Strategy | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
Findings35
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 2 | 2 |
| Low | 2 | 9 | 17 |
Marked Informational or Gas Optimization by the firms. Not counted as findings.
InformationalBatch fulfill griefing via approval frontrunningSky: Spark Saving Intents · Cantina · 11 Mar 2026Acknowledged
The report gives no description here.
Open the reportInformationalLarge depositor can temporarily block deposits by lowering cap before exec()Sky: CapAutomator · Cantina · 25 Feb 2026Acknowledged
The report gives no description here.
Open the reportInformationalQuantifying the max loss for an OTC exchangeSky: Spark ALM Controller v1. · Cantina · 14 Nov 2025Acknowledged
The report gives no description here.
Open the reportInformationalThe setOTCBuffer and setOTCRechargeRate could be combined into one functionSky: Spark ALM Controller v1. · Cantina · 14 Nov 2025Acknowledged
The report gives no description here.
Open the reportInformationalWSTETH_WITHDRAW_QUEUE withdrawals limits affect the requestWithdrawFromWstETHSky: Spark ALM Controller v1. · Cantina · 14 Nov 2025Acknowledged
The report gives no description here.
Open the reportInformationalCannot perform a pure staking farm rewards claimSpark ALM Controller · Cantina · 18 Aug 2025Acknowledged
The report gives no description here.
Open the reportInformationalQuirks in OFT implementationsspark-alm-controller v1. · Cantina · 23 Jul 2025Acknowledged
The report gives no description here.
Open the reportInformationalIncreased risks of unwanted share price manipulation by manipulating the pocket USDC balanceMakerDAO Spark PSM3 Governance Audit · Cantina · 23 Oct 2024Acknowledged
The report gives no description here.
Open the reportInformationalMissing domain checks in the initializationMakerDAO Spark ALM Init Script Audit · Cantina · 23 Oct 2024Acknowledged
The report gives no description here.
Open the reportInformationalThe mintRecipient is already checked in the TokenMessengerSpark ALM CCTP & Swap Logic Audit · Cantina · 25 Sep 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
InformationalArbitrum's Retryable Tickets cannot be cancelled.xchain-helpers; spark-gov-relay · Cantina · 9 Sep 2024Acknowledged
The report gives no description here.
Open the reportInformationalDSROracle's pot data starts uninitializedxchain-dsr-oracle · Cantina · 9 Sep 2024Acknowledged
The report gives no description here.
Open the reportInformationalExecutor does not support actions sending native tokens to EOAxchain-helpers; spark-gov-relay · Cantina · 9 Sep 2024Acknowledged
The report gives no description here.
Open the reportInformationalPSM3 treats asset0 and asset1 as 1-to-1 leading to potential LP losses in a depeg eventSpark PSM3 Contract Security Audit · Cantina · 9 Sep 2024Acknowledged
The report gives no description here.
Open the reportInformationalNo donations supportedsparklend-conduits · Cantina · 19 Nov 2023Acknowledged
The report gives no description here.
Open the reportInformationalNo inherent reward handlingsparklend-conduits · Cantina · 19 Nov 2023Acknowledged
The report gives no description here.
Open the reportInformationalDeployment silently truncates term and cliffSky: Spark Boosted Vault · Cantina · 14 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalmaxDeposit() can quote non-zero deposits that always revertSky: Spark Boosted Vault · Cantina · 14 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalmaxLiability() can be lower than totalPrincipalSky: Spark Boosted Vault · Cantina · 14 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalMinor issues, Typos & DocumentationSky: Spark Boosted Vault · Cantina · 14 Aug 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalRequest updates reset queue priority and no partial fill increases user execution delaySky: Spark Saving Intents · Cantina · 11 Mar 2026Fixed
The report gives no description here.
Open the reportInformationalUse reserve-configuration decimals to mirror Aave cap math exactlySky: CapAutomator · Cantina · 25 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalEvent Emission Before State ChangeSparklend Cap Automator · ChainSecurity · 17 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalGas OptimizationsSparkLend Advanced · ChainSecurity · 17 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalRemove Non-Existing Config Is PossibleSparklend Cap Automator · ChainSecurity · 17 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalDocumentation & minor issuesSky: Spark ALM Controller v1. · Cantina · 14 Nov 2025Fixed
The report gives no description here.
Open the reportInformationalHardcode the spender to ALM Proxy in OTCBufferSky: Spark ALM Controller v1. · Cantina · 14 Nov 2025Fixed
The report gives no description here.
Open the reportInformationalMissing OTC check in setOTCWhitelistedAssetSky: Spark ALM Controller v1. · Cantina · 14 Nov 2025Fixed
The report gives no description here.
Open the reportInformationalThe ForeignControllerInit missing maxSlippage setSky: Spark ALM Controller v1. · Cantina · 14 Nov 2025Fixed
The report gives no description here.
Open the reportInformationalMissing functions from ISparkVaultSky: Spark Vaults v2 · Cantina · 19 Sep 2025Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalTaker can take assets out of vault and deposit themSky: Spark Vaults v2 · Cantina · 19 Sep 2025Fixed
The report gives no description here.
Open the reportInformationalALM Proxy Cannot ReceiveSpark ALM Controller · ChainSecurity · 11 Sep 2025Fixed
The report gives no description here.
Open the reportInformationalConstructor ParametersSpark ALM Controller · ChainSecurity · 11 Sep 2025Fixed
The report gives no description here.
Open the reportInformationalEventsSpark ALM Controller · ChainSecurity · 11 Sep 2025Fixed
The report gives no description here.
Open the reportInformationalMint Recipient Is Not InitializedSpark ALM Controller · ChainSecurity · 11 Sep 2025Fixed
The report gives no description here.
Open the reportInformationalSanity Checks In Deployment ScriptsSpark ALM Controller · ChainSecurity · 11 Sep 2025Fixed
The report gives no description here.
Open the reportInformationalThe superstateRedemption and artifacts can be removedSky Spark ALM Controller · Cantina · 11 Sep 2025Fixed
The report gives no description here.
Open the reportInformationalUnused ParametersSpark ALM Controller · ChainSecurity · 11 Sep 2025Fixed
The report gives no description here.
Open the reportInformationalImproved documentationSpark ALM Controller · Cantina · 18 Aug 2025Fixed
The report gives no description here.
Open the reportGas Optimization_approve can re-use approveData in third callspark-alm-controller v1. · Cantina · 23 Jul 2025Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalConsistent IRateLimits rateLimits parameter orderspark-alm-controller v1. · Cantina · 23 Jul 2025Fixed
The report gives no description here.
Open the reportInformationalDeployment scripts set mintRecipients (for CCTP bridging) but no LayerZero recipientsspark-alm-controller v1. · Cantina · 23 Jul 2025Fixed
The report gives no description here.
Open the reportInformationalILayerZero interface improvementsspark-alm-controller v1. · Cantina · 23 Jul 2025Fixed
The report gives no description here.
Open the reportInformationalMinor issuesspark-alm-controller v1. · Cantina · 23 Jul 2025Fixed
The report gives no description here.
Open the reportInformationalFunction Visibility Can Be Restricted to ExternalSparkRewards · ChainSecurity · 25 Feb 2025Fixed
The report gives no description here.
Open the reportInformationalInaccurate Error MessageSparkRewards · ChainSecurity · 25 Feb 2025Fixed
The report gives no description here.
Open the reportInformationalInconsistent Coding StyleSparkRewards · ChainSecurity · 25 Feb 2025Fixed
The report gives no description here.
Open the reportInformationalNo Fixed Solidity VersionSpark Vaults · ChainSecurity · 24 Jan 2025Fixed
The report gives no description here.
Open the reportInformationalUnused FunctionSpark Vaults · ChainSecurity · 24 Jan 2025Fixed
The report gives no description here.
Open the reportInformationalInconsistenciesXChain SSR Oracle · ChainSecurity · 20 Jan 2025Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalOutdated IPot InterfaceXChain SSR Oracle · ChainSecurity · 20 Jan 2025Fixed
The report gives no description here.
Open the reportInformationalRedundant GettersXChain SSR Oracle · ChainSecurity · 20 Jan 2025Fixed
The report gives no description here.
Open the reportInformationalImproved admin check in the initialization script for the ControllersMakerDAO Spark ALM Init Script Audit · Cantina · 23 Oct 2024Fixed
The report gives no description here.
Open the reportInformationalMissing PSM checks within the initialization of the Foreign ControllerMakerDAO Spark ALM Init Script Audit · Cantina · 23 Oct 2024Fixed
The report gives no description here.
Open the reportInformationalRevoking the oldController can silently fail, leading to an unsuccessful role revocationMakerDAO Spark ALM Init Script Audit · Cantina · 23 Oct 2024Fixed
The report gives no description here.
Open the reportInformationalTypos in commentsMakerDAO Spark PSM3 Governance Audit · Cantina · 23 Oct 2024Fixed
The report gives no description here.
Open the reportInformationalUnused pocket functionMakerDAO Spark ALM Init Script Audit · Cantina · 23 Oct 2024Fixed
The report gives no description here.
Open the reportInformationalGas OptimizationsSpark PSM · ChainSecurity · 22 Oct 2024Fixed
The report gives no description here.
Open the reportInformationalImproved commentsSpark ALM CCTP & Swap Logic Audit · Cantina · 25 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalMissing comment about counterintuitive quote amount in swapSpark ALM CCTP & Swap Logic Audit · Cantina · 25 Sep 2024Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalThe doCall forwarding the callvalue is counterintuitiveSpark ALM CCTP & Swap Logic Audit · Cantina · 25 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalThe psm.to18ConversionFactor() call can be cachedSpark ALM CCTP & Swap Logic Audit · Cantina · 25 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalUnused variables and missing check within ForeignControllerSpark ALM CCTP & Swap Logic Audit · Cantina · 25 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalInconsistenciesXChain SSR Oracle · ChainSecurity · 11 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalOutdated IPot InterfaceXChain SSR Oracle · ChainSecurity · 11 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalRedundant GettersXChain SSR Oracle · ChainSecurity · 11 Sep 2024Fixed
The report gives no description here.
Open the reportInformational_divUp(0, 0) returns 0 instead of revertingSpark PSM3 Contract Security Audit · Cantina · 9 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalClarify ambiguous natspec for Executor's signatures parameterxchain-helpers; spark-gov-relay · Cantina · 9 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalDSRBalancerRateProviderAdapter.getRate() documentation improvementxchain-dsr-oracle · Cantina · 9 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalImproved checks in the setPotDataxchain-dsr-oracle · Cantina · 9 Sep 2024Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalImproved require check in getConversionRate, getConversionRateBinomialApprox and getConversionRateLinearApproxxchain-dsr-oracle · Cantina · 9 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalMissing RateProvider check in the deploy scriptSpark PSM3 Contract Security Audit · Cantina · 9 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalObsolete DEFAULT_ADMIN_ROLE assignment to DATA_PROVIDER_ROLExchain-dsr-oracle · Cantina · 9 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalObsolete DEFAULT_ADMIN_ROLE assignment to Executor's rolesxchain-helpers; spark-gov-relay · Cantina · 9 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalThe executionTimecan be removed from _executeTransactionxchain-helpers; spark-gov-relay · Cantina · 9 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalThe gracePeriod check can be moved inside the _updateGracePeriodxchain-helpers; spark-gov-relay · Cantina · 9 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalTypographical issue in IPSM3.solSpark PSM3 Contract Security Audit · Cantina · 9 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalUnsafe cast of the gasLimit in OptimismForwarderxchain-helpers; spark-gov-relay · Cantina · 9 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalPartially Inaccurate Function DescriptionSpark User Actions · ChainSecurity · 4 Sep 2024Fixed
The report gives no description here.
Open the reportInformationalCustom division function _divup misbehaves when 0 is divided by 0sparklend-conduits · Cantina · 19 Nov 2023Fixed
The report gives no description here.
Open the reportShow 8 more
InformationalInvariants are not strict equalities because of different rounding between Conduit and Sparksparklend-conduits · Cantina · 19 Nov 2023Fixed
The report gives no description here.
Open the reportInformationalUnused PotLike interfacesparklend-conduits · Cantina · 19 Nov 2023Fixed
The report gives no description here.
Open the reportInformationalFloating PragmaSparkLendConduit · ChainSecurity · 30 Oct 2023Fixed
The report gives no description here.
Open the reportInformationalGas OptimizationsSparkLendConduit · ChainSecurity · 30 Oct 2023Fixed
The report gives no description here.
Open the reportInformationalInaccurate Naming and CommentsSparkLendConduit · ChainSecurity · 30 Oct 2023Fixed
The report gives no description here.
Open the reportInformationalMissing EventSparkLendConduit · ChainSecurity · 30 Oct 2023Fixed
The report gives no description here.
Open the reportInformationalOutdated Aave Version UsedSparkLendConduit · ChainSecurity · 30 Oct 2023Fixed
The report gives no description here.
Open the reportInformationalsubsidySpread OverflowSparkLendConduit · ChainSecurity · 30 Oct 2023Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="spark"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us