Velocimeter security record
As of 10 Nov 2026, Velocimeter has 1 audit report on Trustblock, by Sherlock, dated 25 Jul 2024. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits0· Audit competitions 1
Newest first
| Report | Security firm | Date | Scope | Critical findings | Source |
|---|---|---|---|---|---|
| Velocimeter auditAudit competition | Security firm: Sherlock | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
Findings18
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 9 |
| Medium | 0 | 0 | 9 |
| Low | 0 | 0 | 0 |
HighDepositWithLock done via OptionToken can be abused to permanently lock a user positionVelocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportHighExercising a large amount of options gives significantly higher discounts than supposed to.Velocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportHighIf user merges their veNFT, they'll lose part of their rewardsVelocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportHighOptionTokenV4.exerciseLP's addLiquidity lack of slippage can be abused to make victims exercise for a lower liquidity than intendedVelocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportHighpause or kill gauge can lead to FLOW token stuck in voterVelocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportHighpoke() may be dosVelocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportHighve_supply is updated incorrectlyVelocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportHighvoters cannot disable max lockVelocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportHighVotingEscrow MAX_DELEGATES value can lead to DOS on certain EVM-compatible chainsVelocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportMediumFirst liquidity provider of a newly created stable pair can cause DOS and loss of fundsVelocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportShow 8 more
MediumIncorrect calculation of TWAP in OptionTokenV4.getTimeWeightedAveragePrice() function.Velocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportMediumRewards supplied to a gauge, prior to its first depositor will be permanently lost.Velocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportMediumswap may be reverted if the input amount is not large enough, especially for low decimal tokensVelocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportMediumThe circulating_supply() of the Minter contract may revert, resulting in the inability of the Minter to periodically emit Flow tokensVelocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportMediumupdate_period(..) leads to wrong calculation in weekly emissions breaking accounting for the protocolVelocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportMediumUser can make their veNFT unpokeable by voting for a to-be-killed gaugeVelocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportMediumVoter.replaceFactory() and Voter.addFactory() functions are broken.Velocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportMediumVoting power does not decay when calculating shares of flow emissions if the user does not vote again.Velocimeter audit · Sherlock · 25 Jul 2024Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="velocimeter-v4"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us