Tori Finance security record
As of 21 Oct 2026, Tori Finance has 2 audit reports by 2 security firms on Trustblock; the latest is by Nethermind Security, dated 26 Mar 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Tori security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Tori Finance audit | Security firm: Sherlock | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings27
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 2 | 6 |
| Low | 0 | 6 | 12 |
HightransferToCustody() function always reverts due to incorrect validation of ERC20 token address against EOA checkTori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportMediumBlacklisted users can retrieve silo funds via unstake(), bypassing blacklist restrictionsTori security review · Nethermind Security · 26 Mar 2026Fixed
The report gives no description here.
Open the reportMediumBlacklisted shares continue earning rewards during vesting periodTori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportMediumMissing FULL_RESTRICTED_STAKER_ROLE check in StakedTrUSD _deposit allows sanctioned entities to deposit fundsTori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportMediumRounding errors in ratio calculations can leave unaccounted tokens in the contractTori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportMediumSOFT_RESTRICTED_STAKER_ROLE can bypass restrictions and withdraw with yieldTori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportMediumStakedTrUSD.reportLoss is blocked during vesting, preventing handling of bad debt and allowing users to exit fully, forcing remaining stakers to bear the lossTori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportLowremoveAllowedToken cannot remove disabled tokens, creating permanently orphaned storage entriesTori security review · Nethermind Security · 26 Mar 2026Fixed
The report gives no description here.
Open the reportLowToriTimelock delay bounds only enforced at construction, bypassable via inherited updateDelayTori security review · Nethermind Security · 26 Mar 2026Fixed
The report gives no description here.
Open the reportLowTrUsdSilo lacks withdrawal for other assetsTori security review · Nethermind Security · 26 Mar 2026Fixed
The report gives no description here.
Open the reportShow 9 more
LowCompilation Failure Due to ReentrancyGuardUpgradeable Removal in OpenZeppelin v5.5Tori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportLowCooldown duration changes create unfair waiting periodsTori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportLowEvent parameter order inconsistencyTori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportLowMisleading error message in blacklist access controlTori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportLowMissing validation allows rate limit window to be set to zeroTori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportLowNo way to cancel or reduce cooldown requestsTori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportLowOwner can be blacklisted in StakedTrUSDOFT and causing cross-chain transfers to failTori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportLowrescueOrphanFunds fails to reset vestingAmount causing temporary DoSTori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportLowRewardsReceived event emits identical valuesTori Finance audit · Sherlock · 22 Jan 2026Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="tori-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us