Token launchpad audit

C-01Axis · Critical

Anyone could call settle with any slippage limit. An auction buyer could initialize the Uniswap V3 pool at a high price, settle into it, then sell their tokens there for a profit.

Pool seeding Read the finding C-01 in the Axis Periphery Contracts report

H-02Clanker · High

Launch supply was checked as the source’s balance, never the token’s real totalSupply. A creator could add a second mint call and hold five times the launch supply, ready to sell into the new pool.

Supply Read the finding H-02 in the Clanker Protocol Review report

H-09Clanker · High

When the token sorted second, Pancake launches were valued at one price but placed liquidity in a mirrored range. A creator could grind a salt, pass the FDV guard and still list far from the approved valuation.

Launch guards Read the finding H-09 in the Clanker Protocol Review report

H-03g8keep · High

Deployers paid a 2% fee on the liquidity they passed to the factory. Sending most of it straight to the precomputed pair first cut a 2 WETH fee to 0.002 WETH for the same launch.

Launch fees Read the finding H-03 in the g8keep Token Launchpad report

H-03Gamma Unilaunch · High

Creators could supply their own auction factory, and the launch strategy trusted whatever it returned. A fake auction could siphon the token supply and lock or sweep bidders’ funds.

Factory inputs Read the finding H-03 in the Gamma Unilaunch Launchpad and Limit Order Book report

C-01g8keep · Critical

The vester never initialized lastClaim, so the first claim counted the whole block timestamp as elapsed time. A deployer could show holders a 55-year vest and claim every token right after launch.

Vesting Read the finding C-01 in the g8keep Token Launchpad report

C-02Animecoin · Critical

The ANIME claimer reset its daily withdrawal counter only on a nonzero withdrawal. Once one day’s limit was reached, it never reset, and every later claim was blocked.

Claims Read the finding C-02 in the Animecoin ANIME Claimer report

C-03Zap Node Sale · Critical

Early-unstake fees were paid from the vesting contract’s ZAP, not the user’s. Staking and unstaking in a loop could drain the tokens holders needed for their vested claims.

Node sales Read the finding C-03 in the Zap Node Sale report

H-01Clanker · High

Each launch required the core contract to end with exactly zero ETH. Anyone could force ETH in with selfdestruct, and every later launch reverted.

Forced ETH Read the finding H-01 in the Clanker Protocol Review report

C-03Degen Safe · Critical

The reward vault PDA was derived from the reward mint alone, so pools paying the same token shared one vault. The first pool’s owner could withdraw rewards another pool had deposited.

Solana PDAs Read the finding C-03 in the Degen Safe Protocol Review report

$44.7MHedgey Finance

Hedgey lost about $44.7 million through its token claim contract. Rekt traces it to unverified user input, which let the attacker obtain token approvals.

Apr 2024 Our coverage of the Hedgey Finance incident

$5MZKsync airdrop

An attacker compromised the admin account of three ZKsync airdrop contracts. Calling sweepUnclaimed(), they minted 111 million unclaimed ZK, worth about $5 million.

Apr 2025 Our coverage of the ZKsync airdrop incident