Vechain SDK

CertiKCode version: not recorded (see the report)

CertiK reviewed VeChain (Vechain SDK) on 3 Mar 2025: 15 findings, 0 critical; 7 marked fixed, 8 open.

No open critical findings
Open the reportOpen VeChain’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings15

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low807
LowCertificate Signature Validation in ConstructorOpen

In the constructor of the `Certificate` object, the `signature` is not checked to be corresponding to the input `signer` when creating the certificate with the optional signature parameter.

LowInconsistency Between Comment and Code in `eth_chOpen

The `eth_chainid` method is used to get the chainId, based on the `genesisBlock.id`. The function returns either the mainnet chain ID or the testnet chain ID. However, the pointed comment indicates `// Testnet OR Solo OR some other network`. The cases for `Solo` or for `some other network` are not covered.

LowLack of Optional Password Parameter in `HDKey.ts#Open

The `HDKey.ts#fromMnemonic()` function is responsible for generating an HD key from a given mnemonic. This function internally utilizes [scure-bip39#mnemonicToSeedSync()](https://github.com/paulmillr/scure-bip39/blob/main/src/index.ts#L137) to derive a 64-byte key from the mnemonic, along with an optional password. The `mnemonicToSeedSync()` function provides flexibility by allowing a `passphrase` parameter, which can be used to offer additional protection for the key generation process. However, the current implementation of the `HDKey.ts#fromMnemonic()` function does not provide an option to input this password parameter, thereby removing the additional layer of security that the `scure-bip39#mnemonicToSeedSync()` function is capable of offering.

LowMissing Documentation for Input ParametersOpen

The pointed functions have some input parameters that lack documentation in the JSDoc comment, despite being used in the method implementation. The lack of documentation can cause confusion for developers, making it harder to understand the parameter's purpose, expected format, and behavior.

LowPending Block as Accepted OnesOpen

The `getCorrectBlockNumberRPCToVeChain` function groups all possible blocks states to the `best` one, that, as reported in code comments, represents the sole state to represent them all. However, comments do not mention the `pending` state, which differently from all the other reported cases, may report a block that did not undergo the chain consensus process, thus providing transient or false information. Since all states are treated in the same way, function caller may obtain incorrect data.

LowRedundant Operation in `Certificate.ts`Open

In `Certificate.ts`, the `encode()` function is designed to nullify the `signature` of the certificate by setting it to `undefined` before returning the encoded object: ```typescript=183 public encode(): Uint8Array { return Certificate.encode({ ...this, signature: undefined }); } ``` Within the `sign()` and `verify()` functions, the `this.signature` property is explicitly set to `undefined` before calling the `encode(object: unknown)` function. This approach can be simplified, as the `encode()` function already handles the nullification of the `signature`.

LowTyposOpen

There are typos in the code: - In `hardhat-provider.ts`: - The comment `Overload off ...` should be `Overload of`. - In `vechain-abstract-signer.ts`: - The comment `Estimates the required gas required to execute //tx// on the Blockchain` has one too many `required` in it. Consider removing one of them.

LowUnnecessary Condition in KMSVeChainSignerOpen

The `KMSVechainSigner` constructor allows the creation of an instance of the signer with the following combinations: - The `provider` is not undefined. - The `delegator` is not undefined - The `delegator_url` is not undefined. In the third case the `KMSVeChainSigner` will be instantiated with an empty `provider`, empty `delegator provider`, and non-empty `delegator_url`. The function `concatSignatureIfDelegation()` used when signing a transaction concatenates the delegator's signature from the `kmsVeChainDelegatorProvider` if it is set. If the `kmsVeChainDelegatorProvider` is undefined the function retrieves the delegator's signature using the `kmsVeChainDelegatorUrl` and the `provider`: ```typescript=261 ... else if ( // If not, we try with the delegator URL this.kmsVeChainDelegatorUrl !== undefined && this.provider !== undefined ) ... ``` However, the function calls `this.buildVeChainSignatureFromPayload()` before reaching the abovementioned check which throws an error if `this.kmsVeChainProvider` is undefined. Since `this.kmsVeChainProvider` is assigned to `this.provider` in the `KMSVeChainSigner` constructor, the check `this.provider !== undefined` in the `else if` of `concatSignatureIfDelegation()` is redundant.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of VeChain’s security record

VeChain
Audits6 audits by 3 firmsLast audit Feb 2026, by Hacken.
Critical findingsNo open critical findingsAcross the 6 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it.
Open VeChain’s security record

Security firm

CertiK

1,044 projects reviewed · 1,393 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us