Security Rating Level: 3
Evaluation Date: September 30th, 2021
1. History & Team (Weight 20%; Score 65)
1.1 Project age (8%; 80)
Launched on Polygon in 2021 February, alive for 8 months.
1.2 Past exploits (8%; 70)
Was not attacked on Polygon since launch, but was attacked once on Ethereum in 2021 September (the affected contract was not employed in Polygon)
1.3 Team anonymity (2%; 30)
Team are anonymous
1.4 Team experience in programming (2%; 20)
Unknown
2. Exposure (Weight 25%; Score 74.9)
2.1 Historical TVL (17.5%; 72)
Average market share in the past 2Q: 9.0%, 14.0%
Data collected from DeBank | DeFi Wallet for Ethereum Users
2.2 Industry segment (5%; 90)
SushiSwap is an exchange
2.3 Infrastructure (2.5%; 65)
Use single decentralised oracle (Chainlink) to feed price
3. Audit (Weight 35%; Score 90)
Audit report available on: GitHub - quantstamp/sushiswap-security-review and publications/PeckShield-Audit-Report-SushiSwap-v1.0.pdf at master · peckshield/publications · GitHub
3.1 Transparency and scope (14%; 100)
Full scope audit done, and report is public
3.2 Audit firm trust score (10.5%; 70)
Audited by PeckShield and Quantstamp, Tier 2 audit firm
3.3 Audit findings (10.5%; 80)
No critical issues found in audit
3.4 Other credits (up to additive 5.25%; 5)
Audit done before deployment
4. Code quality (Weight 15%; Score 30)
Repository on github: GitHub - sushiswap/sushiswap: Sushiswap smart contracts 🍣 📝
4.1 Documentation
Documentation is not clear
4.2 Test
Test done but code coverage not visible
5. Developer community (Weight 5%; Score 90)
5.1 Bug bounty program (3.5%; 90)
Exists. Reward up to $150,000
5.2 Issues raised on Github (1.5%; 90)
10 issues raised on github repository
The N-SCOSS for Compound is 72.225, level 3