Audit report published Oct 2025. Solidity.
| Severity | Count |
|---|---|
| Critical | 1 |
| High | 1 |
| Medium | 1 |
| Low | 4 |
| Informational | 5 |
| Total | 12 |
Safe Edges reviewed Clique's distribution and streaming hook contracts (CliqueLockHook, Distributor, BaseDistributor and TransferHook) between 18 and 28 September 2025. Twelve issues were identified: one Critical, one High, one Medium, four Low and five Informational, two of which are gas optimisations. The Critical issue let anyone call CliqueLockHook.execute and overwrite a recipient's stream reference, and the High issue was an immutable variable assignment that stopped the contract compiling. Clique fixed six issues in commit 836c1c8, including the Critical and High, and acknowledged six: the Medium, all four Low and one gas issue.
C-01 Unchecked overwrite of streamIds mapping in CliqueLockHook.execute() function — ResolvedH-01 Incorrect Assignment of Immutable IS_FIXED_START in CliqueLockHook.sol — ResolvedM-01 Missing Validation of Total Proportions in Distributor.setHooks — AcknowledgedL-01 Absence of validation in BaseDistributor.setActiveWindow — AcknowledgedL-02 Distributor.setHooks allows fallback index equal to strategies.length — AcknowledgedL-03 Token Approval Not Reset in CliqueLockHook.execute — AcknowledgedL-04 Missing Validation in CliqueLockHook.setStreamPreset — AcknowledgedI-01 Unused constructor parameter in TransferHook.sol — ResolvedI-02 Unused import — ResolvedI-03 State Change Without Event — ResolvedG-01 Unused Error — ResolvedG-02 Avoid zero assignment in for loops counters for gas efficiency — AcknowledgedSend the repository and a commit hash through the contact form, message @bugtester25 on Telegram, or book a 30-minute scoping call. 200+ protocols audited · $4B+ secured · 0 hacks post-audit. Prefer email? info@safeedges.in.