Trader Joe security record
As of 30 Oct 2026, Trader Joe has 12 audit reports by 3 security firms on Trustblock; the latest is by Paladin, dated 31 Mar 2024. Those reports list no open critical findings. It also holds 40 deployed contracts on 1 chain.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits12
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| For Trader Joe (Core v2. | Security firm: Paladin | Date: | Scope: 9 addresses on Avalanche, BNB Chain and Arbitrum | No open critical findings | Open · IPFS |
| Audit Report - Trader Joe (Auto Pools) | Security firm: Paladin | Date: | Scope: 9 addresses on Avalanche, BNB Chain and Arbitrum | No open critical findings | Open · IPFS |
| Audit Report - Trader Joe (v2 Vaults) | Security firm: Paladin | Date: | Scope: 12 addresses on Avalanche, BNB Chain and Arbitrum | No open critical findings | Open · IPFS |
| Audit Report - Trader Joe (DEX v2. | Security firm: Paladin | Date: | Scope: 6 addresses on Avalanche, BNB Chain and Arbitrum | No open critical findings | Open · paladinsec.co |
| Audit Report - Trader Joe Reward Distributor | Security firm: Paladin | Date: | Scope: 3 addresses on Avalanche, BNB Chain and Arbitrum | No open critical findings | Open · IPFS |
| Audit Report - Trader Joe Launchpeg | Security firm: Paladin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · IPFS |
| Trader Joe Boostedmasterchefjoe | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Trader Joe | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Audit Report | Security firm: Paladin | Date: | Scope: 4 addresses on Avalanche | No open critical findings | Open · paladinsec.co |
| Audit Report - Trader Joe Lending | Security firm: Paladin | Date: | Scope: 69 addresses on Avalanche, BNB Chain and Arbitrum | No open critical findings | Open · IPFS |
| Audit Report - Trader Joe MasterChefV3 | Security firm: Paladin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · IPFS |
| TraderJoe Lending | Security firm: HashEx | Date: | Scope: Repository at commit 99e44ae | No open critical findings | Open · hashex.org |
Findings246
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 5 | 15 |
| Medium | 6 | 8 | 14 |
| Low | 30 | 33 | 133 |
HighGovernance Privilege: Hook modification privilegeFor Trader Joe (Core v2. · Paladin · 31 Mar 2024Acknowledged
The report gives no description here.
Open the reportHighWithdrawals can potentially revertAudit Report - Trader Joe (Auto Pools) · Paladin · 25 Jul 2023Acknowledged
The report gives no description here.
Open the reportHighGovernance risk: The staking contract is upgradeableAudit Report · Paladin · 9 Feb 2022Acknowledged
The report gives no description here.
Open the reportHighUntitled findingAudit Report - Trader Joe Lending · Paladin · 5 Oct 2021Acknowledged
The report gives no description here.
Open the reportHighUntitled findingAudit Report - Trader Joe Lending · Paladin · 5 Oct 2021Acknowledged
The report gives no description here.
Open the reportMediumContracts without fallback functions might not accept the native tokenFor Trader Joe (Core v2. · Paladin · 31 Mar 2024Acknowledged
The report gives no description here.
Open the reportMediumUsers may grief rewards by abusing known attack-vector to temporarily DoS swapsFor Trader Joe (Core v2. · Paladin · 31 Mar 2024Acknowledged
The report gives no description here.
Open the reportMediumUsers will lose additional rewards when rewarder is changedAudit Report - Trader Joe (Auto Pools) · Paladin · 25 Jul 2023Acknowledged
The report gives no description here.
Open the reportMediumUntitled findingAudit Report - Trader Joe Lending · Paladin · 5 Oct 2021Acknowledged
The report gives no description here.
Open the reportMediumUntitled findingAudit Report - Trader Joe Lending · Paladin · 5 Oct 2021Acknowledged
The report gives no description here.
Open the reportShow 10 more
MediumUntitled findingAudit Report - Trader Joe Lending · Paladin · 5 Oct 2021Acknowledged
The report gives no description here.
Open the reportMediumUntitled findingAudit Report - Trader Joe Lending · Paladin · 5 Oct 2021Acknowledged
The report gives no description here.
Open the reportMediumUntitled findingAudit Report - Trader Joe Lending · Paladin · 5 Oct 2021Acknowledged
The report gives no description here.
Open the reportLowBroken MasterChef prevents state changes within LBPairFor Trader Joe (Core v2. · Paladin · 31 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowDelta bins are not set upon initializationFor Trader Joe (Core v2. · Paladin · 31 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowLack of address(0) check after cloningFor Trader Joe (Core v2. · Paladin · 31 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowLogic is not compatible with extraRewarder from Merchant Moe MasterChefFor Trader Joe (Core v2. · Paladin · 31 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowOracle is still vulnerable to manipulationFor Trader Joe (Core v2. · Paladin · 31 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowRemoval of ExtraRewarder will prevent users from claiming rewardsFor Trader Joe (Core v2. · Paladin · 31 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowRewards are distributed retroactively if the active range has no liquidity (BaseRewarder)For Trader Joe (Core v2. · Paladin · 31 Mar 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowSophisticated but unrealistic exploit allows for DoS in the pair under extreme situationsFor Trader Joe (Core v2. · Paladin · 31 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowUnfair reward distribution due to using liquidity to determine pro- rata amountFor Trader Joe (Core v2. · Paladin · 31 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowUsers can only claim as long as the rewarder is linkedFor Trader Joe (Core v2. · Paladin · 31 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowChanging rewarder implementation may lock funds in previous rewardersAudit Report - Trader Joe (Auto Pools) · Paladin · 25 Jul 2023Acknowledged
The report gives no description here.
Open the reportLowUsing a nonce as salt for deployment via create2 makes the use of create2 redundantAudit Report - Trader Joe (Auto Pools) · Paladin · 25 Jul 2023Acknowledged
The report gives no description here.
Open the reportLowAttacker can DoS the rebalanceAudit Report - Trader Joe (v2 Vaults) · Paladin · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowAUM fee is charged on entire deposits, not only profitsAudit Report - Trader Joe (v2 Vaults) · Paladin · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowComposition fee might be appliedAudit Report - Trader Joe (v2 Vaults) · Paladin · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowFirst depositor determines the ratioAudit Report - Trader Joe (v2 Vaults) · Paladin · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowFrontend phishing riskAudit Report - Trader Joe (v2 Vaults) · Paladin · 11 May 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowHardcoded dataFeedsAudit Report - Trader Joe (v2 Vaults) · Paladin · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowIncompatibility with tokens that have a fee on transferAudit Report - Trader Joe (v2 Vaults) · Paladin · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowLack of events for several functionsAudit Report - Trader Joe (v2 Vaults) · Paladin · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowLack of non-zero validationAudit Report - Trader Joe (v2 Vaults) · Paladin · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowrebalance and swap can have very high slippageAudit Report - Trader Joe (v2 Vaults) · Paladin · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowWhitelisted users not publicly visibleAudit Report - Trader Joe (v2 Vaults) · Paladin · 11 May 2023Acknowledged
The report gives no description here.
Open the reportLowGas optimisationsAudit Report - Trader Joe Reward Distributor · Paladin · 11 Jun 2022Acknowledged
The report gives no description here.
Open the reportLowChanging of URL should be locked after all NFTs have been minted and revealedAudit Report - Trader Joe Launchpeg · Paladin · 24 May 2022Acknowledged
The report gives no description here.
Open the reportLowLack of validationAudit Report - Trader Joe Launchpeg · Paladin · 24 May 2022Acknowledged
The report gives no description here.
Open the reportLowTokenomics: Premature revealing could incentivize waiting behaviourAudit Report - Trader Joe Launchpeg · Paladin · 24 May 2022Acknowledged
The report gives no description here.
Open the reportShow 6 more
LowmaxAllocation is vulnerable to Sybil attacksAudit Report · Paladin · 9 Feb 2022Acknowledged
The report gives no description here.
Open the reportLowmint function can be used to pre-mint large amounts of tokens before ownership is transferred to the MasterchefAudit Report · Paladin · 9 Feb 2022Acknowledged
The report gives no description here.
Open the reportLowemergencyWithdraw can be used to take out all reward tokens prematurelyAudit Report - Trader Joe MasterChefV3 · Paladin · 4 Oct 2021Acknowledged
The report gives no description here.
Open the reportLowlpSupply is based on Masterchef contract balanceAudit Report - Trader Joe MasterChefV3 · Paladin · 4 Oct 2021Acknowledged
The report gives no description here.
Open the reportLowPools use the contract balance to figure out the total depositsAudit Report - Trader Joe MasterChefV3 · Paladin · 4 Oct 2021Acknowledged
The report gives no description here.
Open the reportLowsetRewardRate lacks upper limit safeguardsAudit Report - Trader Joe MasterChefV3 · Paladin · 4 Oct 2021Acknowledged
The report gives no description here.
Open the reportContracts40
| Address | Chain | Source code |
|---|---|---|
| 0x8b650e26404ac6837539ca96812f0123601e4448 | Chain: Avalanche | Source code: Verified source |
| 0xdc13687554205e5b89ac783db14bb5bba4a1edac | Chain: Avalanche | Source code: Verified source |
| 0x737fdfb2365973474befa244953954c5b6fddf34 | Chain: Avalanche | |
| 0xce095a9657a02025081e0607c8d8b081c76a75ea | Chain: Avalanche | Source code: Verified source |
| 0x82ea6f7bf853a199ab921137b119b6d41f08038e | Chain: Avalanche | |
| 0x585e7bc75089ed111b656faa7aeb1104f5b96c15 | Chain: Avalanche | Source code: Verified source |
| 0xe6ffd92b9f77fbf5bfec0f3d9c9d027c4cf3ba6e | Chain: Avalanche | |
| 0x2274491950b2d6d79b7e69b683b482282ba14885 | Chain: Avalanche | |
| 0xe34309613b061545d42c4160ec4d64240b114482 | Chain: Avalanche | |
| 0xc988c170d0e38197dc634a45bf00169c7aa7ca19 | Chain: Avalanche | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="trader-joe"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us