Web3 · Smart Contract Audit
Fetch.ai
softstack completed a smart contract audit of Fetch.ai's Agentverse Launchpad in May 2025, reporting 4 findings (1 high, 1 medium and 2 low), of which 3 were resolved or mitigated before the final report. The full report is published in the softstack public audit archive.
Key facts
- Client
- Fetch.ai
- Completed
- Type
- Smart Contract Audit
- Commit
6c5fb0327ebb- Market cap
- $497M as of 2026-10-27
About the project
Fetch.ai is a founding member of the Artificial Superintelligence Alliance, an open-source initiative for decentralised AGI formed in 2024 with SingularityNET and Ocean Protocol. It builds infrastructure for autonomous software agents that communicate, negotiate and transact without human intervention. The alliance stack spans the FET token, the ASI-1 language model and ASI:Chain.
Scope
Source repositorygithub.com/fetchai/launchpadDAOComponents reviewed
1 module- See the published report for the file list
Findings
3 of 4 findings resolved before the final report.
| ID | Title | Severity | Status |
|---|---|---|---|
6.2.1 | Signature Malleability Vulnerability in Multi-Sig Implementation The multi-signature authorization mechanism contains a critical flaw in signature verification that allows signature malleability attacks. | High | fixed |
6.2.2 | Arbitrary Pricing Divisor Vulnerability in FETAgentCoin Contract The FETAgentCoin contract contains an undocumented hard-coded divisor (6) in its core pricing formula, creating an unvalidated economic model vulnerable to manipulation. | Medium | fixed |
6.2.3 | Hardcoded Liquidity Target Vulnerability in FETAgentCoin The contract uses a hardcoded value for liquidity target calculations, creating protocol incompatibility when parameters change. This violates maintainability best practices and could introduce system miscalculations. | Low | acknowledged |
6.2.4 | Unbounded ERC20 Approval Vulnerability in FETAgentCoin Constructor The contract grants infinite ERC20 token allowance to the Uniswap router during initialization, creating a persistent attack vector if the router becomes compromised. | Low | fixed |
Methodology
Review process
Scoping and threat modelling
The commit hash is frozen and the attack surface is mapped: asset flows, trust assumptions, privileged roles and the external systems the code depends on.
Automated analysis
Static analysers sweep the full codebase to surface known weakness patterns, unreachable states and deviations from established conventions.
Manual code review
Independent engineers read the code line by line, concentrating on business logic, access control, arithmetic and the handling of external calls.
Adversarial testing
Property-based fuzzing and invariant tests attack the assumptions the protocol relies on, targeting states that ordinary unit tests never reach.
Reporting
Every finding is documented with a severity rating, its impact, the steps to reproduce it and a concrete remediation the team can act on.
Remediation verification
Submitted fixes are re-reviewed against the original finding, and the final report records the resolved state of each one.
FAQ
The review reported 4 findings: 1 high, 1 medium and 2 low. 3 of 4 were resolved or mitigated before the final report.
The review covered the code in github.com/fetchai/launchpadDAO at commit 6c5fb03. The published report lists every file covered.
This report covers the code as reviewed in May 2025 at commit 6c5fb03. Any code changed after that point is outside the reviewed scope.
Disclaimer
This audit represents a point-in-time security assessment of the reviewed codebase and is intended for informational purposes only. While Softstack applies industry-standard security review methodologies, no audit can guarantee the absence of vulnerabilities, bugs, or other security risks. This report does not constitute financial, legal, regulatory, or investment advice, nor does it endorse the project, its business model, products, or services. Security is an ongoing process, and we strongly recommend conducting a new assessment following any material code changes or at least every 6 months to address newly emerging threats, vulnerabilities, and ecosystem developments.