As of 3 Nov 2026, ValiFi has 1 audit report on Trustblock, by CertiK, dated 22 Aug 2022. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| ValiFi - Audit 2 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 3 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 7 | 0 | 10 |
`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.
Open the reportThe modifier `notAllowed(address _account)` requires that the `_account` must not be present in the mapping `notAllowedList` . This means that the account is an allowed one.
Open the reportIn `ValiFi.sol` within `_beforeTokenTransfer()` the following check ```solidity=188 require(amount <= maxSellAmount, "Lower sell amount."); ``` on function input is made at line 188 after calls to other functions like `_trackTrader()`. --- In `ValiFi.sol` within `_beforeTokenTransfer()` the following check ```solidity=200 require(amount <= maxBuyAmount, "Lower buy amount."); ``` on function input is made at line 200 after calls to other functions like `_trackTrader()`.
Open the reportThere should always be events emitted in the sensitive functions that are controlled by centralization roles.
Open the report**require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.
Open the reportIn `Seller.sol`, the `run()` function has no access controls and is callable by anyone. In addition, there is no functionality built into the contract to accrue tokens to `swapAndLiquify`. Meaning it should only be called after tokens are sent to the contract and the amount in the contract is greater than the `swapThreshold`.
Open the reportLiterals with many digits are difficult to read and review.
Open the reportThe contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one. --- Furthermore the compiler version on all contracts are the same except for `IUniswapV2Pair.sol` and `MinimalForwarderUpgradeable.sol`
Open the reportInside `Seller.sol`, the name `thresholdPercent` can be confusing as the `thresholdDivisor` can be set to a number other than 100.
Open the reportThe linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="valifi"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us