Tokemak security record
As of 21 Oct 2026, Tokemak has 6 audit reports by 2 security firms on Trustblock; the latest is by Hexens, dated 25 Mar 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits6
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Tokemak security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Tokemak security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Tokemak Acctoke Migration security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Tokemak Mainnet Follow Up security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Tokemak security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Tokemak | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings60
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 1 | 9 |
| Medium | 0 | 2 | 15 |
| Low | 1 | 9 | 21 |
CriticalTransient swap routes can be set for other smart contract users to steal tokensTokemak security review · Hexens · 26 Dec 2024Fixed
The report gives no description here.
Open the reportCriticalBroken access control in DestinationVaultMainRewarder:: getReward allows destination vault rewarders to be drainedTokemak Acctoke Migration security review · Hexens · 7 Oct 2024Fixed
The report gives no description here.
Open the reportHighEtherFi and Kelp DAO vault extensions can be DoS-edTokemak security review · Hexens · 26 Dec 2024Fixed
The report gives no description here.
Open the reportHighIncorrect Streaming Fee Share CalculationTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportHighIncorrect update for safeTotalSupply when the distribution is ended in function IncentiveCalculatorBase._snaps hotRewarder()Tokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportHighIncorrect updating of lastUpdateBlock could result in a loss of rewardsTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportHighLoss of Reward from DestinationVaultMainRewarder if the Destination is Empty After RebalanceTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportHighPositive price movements of vault assets can be directly stolen through withdrawTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportHighPotential DoS attack of AutoPool's rebalance and debt reporting functions due to division by zero in profit locking calculation from AutoPoolFeesTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportHighThe value of currentSafeTotalSupply within the function IncentiveCalculatorBase.curren t() can be outdated.Tokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportShow 10 more
High`_executeControllerCommand` Can be Used to Deploy or Withdraw Liquidity by AnyoneTokemak · Quantstamp · 31 Aug 2021Fixed
`_executeControllerCommand` is defined as a public function. This function carries a very dangerous logic, i.e., executing arbitrary transactions without any access control.
Open the reportMediumNavTracking state length is incorrectly increasedTokemak security review · Hexens · 25 Mar 2025Fixed
The report gives no description here.
Open the reportMediumNo restrictions on initialize functionTokemak security review · Hexens · 25 Mar 2025Fixed
The report gives no description here.
Open the reportMediumRedstone oracle and CustomSetOracle time validation differences can lead to issues when updating the priceTokemak security review · Hexens · 26 Dec 2024Fixed
The report gives no description here.
Open the reportMediumLack of StakingPointsExceeded check in AccToke's extend functionTokemak Acctoke Migration security review · Hexens · 7 Oct 2024Fixed
The report gives no description here.
Open the reportMediumPotential Price Calculation Inaccuracy in Standard4626EthOracle.getPric eInEthTokemak Acctoke Migration security review · Hexens · 7 Oct 2024Fixed
The report gives no description here.
Open the reportMediumBridgedLSTCalculator rate can be manipulated through out-of-order message processingTokemak Mainnet Follow Up security review · Hexens · 20 Aug 2024Fixed
The report gives no description here.
Open the reportMediumImproper use of block.timestamp for deadlineTokemak Mainnet Follow Up security review · Hexens · 20 Aug 2024Fixed
The report gives no description here.
Open the reportMediumAutopoolETH redeem incorrectly calculates remaining pull from idleTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportMediumFee configuration update does not sync to latest timestampTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportShow 10 more
MediumImmediate Reward for the First Staker if Time Has PassedTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportMediumMissing deadline parameter in _performLiquidationTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportMediumPotential revert in AutoPoolDebt.withdraw() functionTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportMediumThe discounts on LST stats may be missedTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportMediumUnclaimed rewards in ExtraRewarder can be stolen if removed from MainRewarderTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportMediumUpdate debt reporting does not validate whether spot price is safeTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportLowIncorrect pricing in SlippageBudgetHook could lead to extra slippage countingTokemak security review · Hexens · 25 Mar 2025Fixed
The report gives no description here.
Open the reportLowDirect usage of RedstoneConsumerBase in consumer contractTokemak security review · Hexens · 26 Dec 2024Fixed
The report gives no description here.
Open the reportLowIncentive update extension effectively bypasses the incentive calculator checksTokemak security review · Hexens · 26 Dec 2024Fixed
The report gives no description here.
Open the reportLowInconsistency Between Comment and Implementation in Staking Points CalculationTokemak Acctoke Migration security review · Hexens · 7 Oct 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowInefficient approval flow in AccToke migrationTokemak Acctoke Migration security review · Hexens · 7 Oct 2024Fixed
The report gives no description here.
Open the reportLowWithdrawal requests deletion optimizationTokemak Acctoke Migration security review · Hexens · 7 Oct 2024Fixed
The report gives no description here.
Open the reportLowRedundant Initialization of zeroAddressReached in _validateHooks() FunctionTokemak Mainnet Follow Up security review · Hexens · 20 Aug 2024Fixed
The report gives no description here.
Open the reportLowAccToke minimum stake duration can be zeroTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportLowGas optimisation in fetching total assetsTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportLowIncorrect logic of catching getFee() failingTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportLowNew NAV per share calculation when setting streaming fee could be staleTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportLowSome dust rewards will be stuck in LiquidationRowTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportLowTellorOracle freshness duration configurationTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportLowMissing Parameter ValidationTokemak · Quantstamp · 31 Aug 2021Fixed
The listed parameters are not validated properly: 1. `contracts/wallet/ZeroExTradeWallet.sol:32~33`: check newRouter and newManager against zero addresses 1. `contracts/wallet/ZeroExTradeWallet.sol:46~47`: check `signer` against zero 1. `contracts/controllers/SushiswapController.sol:25~26`: check router snd factory against zero 0. `contracts\manager\Manager.sol::_executeControllerCommand`, should check if `registeredControllers[transfer.controllerId]` is not zero. 0. `contracts\controllers\ZeroExController.sol::constructor`, should check if the input addresses are non-zeros. 0. `contracts\controllers\UniswapController.sol::constructor`, should check if the input addresses are non-zeros. 0. `contracts\pools\Pool.sol::initialize`, should check if the input addresses are non-zeros. 0. `contracts\pools\EthPool.sol::initialize`, should check if the input addresses are non-zeros.
Open the reportShow 7 more
LowPotential Precision Loss in the effectiveSecondsStakedTokemak · Quantstamp · 31 Aug 2021Fixed
Division takes place before multipliciation: ``` uint256 effectiveSecondsStaked = (secondsStaked.div(schedule.interval)).mul(schedule.interval); ``` This potentially leads to precision loss.
Open the reportLowSchedules Cannot be ModifiedTokemak · Quantstamp · 31 Aug 2021Fixed
There is no possiblity to alter properties of a given schedule. It might be needed to set certain props, namely `isActive` and `isPublic`. Not being able to unset `isActive` seems to be a bigger issue. To stop deposits, the only possibilities would be **i)** to pause the contract (which would affects all schedules) or **ii)** remove the schedule of interest.
Open the reportLowSome Functions do not Conform to Contract PausesTokemak · Quantstamp · 31 Aug 2021Fixed
The `withdraw` function in the stated contracts, unlike the deposit function, is not pausable. The same holds true for the `slash` function in the staking contract.
Open the reportLowSushiswap funds are not eligible for SUSHI rewardTokemak · Quantstamp · 31 Aug 2021Fixed
The provided liquidity is not eligible for SUSHI rewards.
Open the reportLowUnlimited Allowance for External ContractTokemak · Quantstamp · 31 Aug 2021Fixed
By calling the functions listed below, the allowance is set to a very large number. This could be used by external contracts that are not under admin team’s control to drain the contract, whenever the target becomes malicious, or being controlled by malicious users. 0. `contracts\controllers\SushiswapController.sol::_approve`. 0. `contracts\controllers\ZeroExController.sol::_approve`. 0. `contracts\controllers\BalancerController.sol::_approve`. 0. `contracts\controllers\UniswapController.sol::_approve`. 0. `contracts\controllers\ZeroExTradeWallet.sol::_approve`.
Open the reportLowZeroExTradeWallet Accepts External Token Addresses and Triggers Untrusted CodeTokemak · Quantstamp · 31 Aug 2021Fixed
Both `deposit` and `withdraw` functions accept external addresses and trust them with calling transfer (safeTransfer) on them. Calling token methods on arbitrary addresses is a bad security practice. At the moment, only the manager can call these methods. Moreover, deposit does not check duplicates before adding tokens to the token list.
Open the reportLowZeroExTradeWallet is Built Upon High Trust in RouterTokemak · Quantstamp · 31 Aug 2021Fixed
All the deposited tokens are approved with the maximum value to be pulled out by the `zeroExRouter` address.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="tokemak"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us