Spool security record
As of 21 Oct 2026, Spool has 10 audit reports by 2 security firms on Trustblock; the latest is by Hexens, dated 2 Sep 2024. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits10
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Spool security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Spool Ethena Strat And Svb security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Spool Strats security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Spool Metamorpho security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Spool Arbitrum security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Spool security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Spool security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Spool Yield Generator Strategy security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Spool Protocol: Spool audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Spool Protocol: Spool audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings36
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 5 |
| Medium | 0 | 2 | 6 |
| Low | 0 | 7 | 15 |
CriticalMetaVault total supply manipulation can lead to asset theftSpool security review · Hexens · 2 Sep 2024Fixed
The report gives no description here.
Open the reportHighMetaVault DoS by user through sync mechanismSpool security review · Hexens · 2 Sep 2024Fixed
The report gives no description here.
Open the reportHighShare price could be manipulatedSpool Arbitrum security review · Hexens · 26 Apr 2024Fixed
The report gives no description here.
Open the reportHighDiscrepancies in _redeemFromProtocol function implementationSpool security review · Hexens · 26 Jan 2024Fixed
The report gives no description here.
Open the reportHigh_GETYIELDPERCENTAGE INCORRECTLY CALCULATES YIELD PERCENTAGESpool Yield Generator Strategy security review · Hexens · 8 Jan 2024Fixed
The report gives no description here.
Open the reportHighProper Reallocation Logic in _processWithdraw()Spool Protocol: Spool audit · PeckShield · 30 Mar 2022Fixed
The report gives no description here.
Open the reportMediumMissing slippage protection in the _getYieldPercentage functionSpool Arbitrum security review · Hexens · 26 Apr 2024Fixed
The report gives no description here.
Open the reportMediumUsage of hardcoded fee for UniV3 poolSpool Arbitrum security review · Hexens · 26 Apr 2024Fixed
The report gives no description here.
Open the reportMediumIncorrect Strategies Hash Update in _- removeStrategyCalldata()Spool Protocol: Spool audit · PeckShield · 30 Mar 2022Fixed
The report gives no description here.
Open the reportMediumProper Fast Withdrawal Logic in _- saveUserShares()Spool Protocol: Spool audit · PeckShield · 30 Mar 2022Fixed
The report gives no description here.
Open the reportShow 10 more
MediumProper Strategy Removal Logic in notifyStrategyRemoved()Spool Protocol: Spool audit · PeckShield · 30 Mar 2022Fixed
The report gives no description here.
Open the reportMediumImproper Vault Proportion Update Upon Strategy RemovalSpool Protocol: Spool audit · PeckShield · 26 Feb 2022Fixed
The report gives no description here.
Open the reportLowMissing _disableInitializers() in MetaVault Implementation ContractSpool security review · Hexens · 2 Sep 2024Fixed
The report gives no description here.
Open the reportLowValidateSmartVaults function returns true when smartVaults array is emptySpool security review · Hexens · 2 Sep 2024Fixed
The report gives no description here.
Open the reportLowAn incorrect originalLength value in the decode function can lead to unexpected decoding resultsSpool Ethena Strat And Svb security review · Hexens · 14 Jun 2024Fixed
The report gives no description here.
Open the reportLowLack of usage _getProtocolRewardsInternal() functionSpool Ethena Strat And Svb security review · Hexens · 14 Jun 2024Fixed
The report gives no description here.
Open the reportLowLack of usage _getProtocolRewardsInternal() functionSpool Strats security review · Hexens · 30 May 2024Fixed
The report gives no description here.
Open the reportLowisRedeemalEmpty should use getMaxRedeemSpool Metamorpho security review · Hexens · 6 May 2024Fixed
The report gives no description here.
Open the reportLowImplement beforeDepositCheckSpool security review · Hexens · 23 Feb 2024Fixed
The report gives no description here.
Open the reportLowAccommodation of Non-ERC20-Compliant TokensSpool Protocol: Spool audit · PeckShield · 30 Mar 2022Fixed
The report gives no description here.
Open the reportShow 7 more
LowEnhanced Validation of Function ArgumentsSpool Protocol: Spool audit · PeckShield · 30 Mar 2022Fixed
The report gives no description here.
Open the reportLowForced Investment Risk in Curve3poolStrategySpool Protocol: Spool audit · PeckShield · 30 Mar 2022Fixed
The report gives no description here.
Open the reportLowProper CompoundStrategy InitializationSpool Protocol: Spool audit · PeckShield · 30 Mar 2022Fixed
The report gives no description here.
Open the reportLowProper Function Type of RiskProviderRegistry::_setRisk()Spool Protocol: Spool audit · PeckShield · 30 Mar 2022Fixed
The report gives no description here.
Open the reportLowProper Logic Of RewardDrip::updatePeriodFinish()Spool Protocol: Spool audit · PeckShield · 30 Mar 2022Fixed
The report gives no description here.
Open the reportLowConsistency of Max128Bit-Based Storage Reads And WritesSpool Protocol: Spool audit · PeckShield · 26 Feb 2022Fixed
The report gives no description here.
Open the reportLowIncorrect MANTISSA Initialization in BalancerStrategySpool Protocol: Spool audit · PeckShield · 26 Feb 2022Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="spool"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us