Astroport Hub Neutron Migration audit
Oak Security reviewed Astroport (Astroport Hub Neutron Migration audit) on 22 May 2024: 9 findings, 2 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings9
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 0 | 6 |
CriticalAttackers can bypass self-migration validation to control assembly contractFixed
The report gives no description here.
CriticalAttackers can manipulate the proposal outcome by transferring voting powersFixed
The report gives no description here.
HighIBC transfers can be grieved, preventing old ASTRO tokens from being burnedFixed
The report gives no description here.
LowDifferent output when timestamp is provided as None and Some(env.block.time.seconds())Fixed
The report gives no description here.
LowExecuteFromMultisig authorization check can be bypassed if the satellite’s contract migration admin is the satellite contract itselfFixed
The report gives no description here.
Lowold_astro_denom and outpost_burn_params validation logic can be improvedFixed
The report gives no description here.
LowQuerying total supply for denom validation is inaccurateFixed
The report gives no description here.
LowTracked denom is not validatedFixed
The report gives no description here.
LowUpdating xASTRO denom prevents proposals from being endedFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Astroport’s security record
AstroportSecurity firm
Oak Security33 projects reviewed · 60 reports · latest May 2026
See Oak Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us