Neutron Independent Chain audit
Oak Security reviewed Neutron (Neutron Independent Chain audit) on 25 Mar 2025: 35 findings, 2 critical; 26 marked fixed, 9 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings35
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 1 |
| High | 0 | 3 | 9 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 5 | 16 |
Marked Informational by the firm. Not counted as findings.
InformationalCode duplication when updating global indexAcknowledged
The report gives no description here.
InformationalCode quality improvementsAcknowledged
The report gives no description here.
InformationalContracts should implement a two-step ownership transferAcknowledged
The report gives no description here.
InformationalContracts should implement a two-step ownership transferAcknowledged
The report gives no description here.
InformationalHardcoded contract addresses may cause deployment misconfigurationsAcknowledged
The report gives no description here.
InformationalInconsistent type usage and redundant parameters in findHooksToRemoveAcknowledged
The report gives no description here.
InformationalInconsistent usage of cons_addressAcknowledged
The report gives no description here.
InformationalInefficient state loading leads to unnecessary resource usageAcknowledged
The report gives no description here.
InformationalLack of documentation regarding consensus participation conditionsAcknowledged
The report gives no description here.
InformationalLack of pausing featureAcknowledged
The report gives no description here.
Show 10 more
InformationalLack of provider attributes in update_providers response hinders debuggingAcknowledged
The report gives no description here.
InformationalLack of slashing event cleanups leads to inefficient state managementAcknowledged
The report gives no description here.
InformationalMisleading comment in the query_voting_power functionAcknowledged
The report gives no description here.
InformationalMisleading comments in the neutron-staking-tracker contractAcknowledged
The report gives no description here.
InformationalMisleading instances in the neutron-staking-vault contractAcknowledged
The report gives no description here.
InformationalMisuse of the Addr type in the neutron-staking-tracker contractAcknowledged
The report gives no description here.
InformationalOptimization by storing precomputed reward rate per block for gas efficiencyAcknowledged
The report gives no description here.
InformationalQuery returns incomplete informationAcknowledged
The report gives no description here.
InformationalSpelling errors in the codebaseAcknowledged
The report gives no description here.
InformationalThe query_user_stake function can be optimizedAcknowledged
The report gives no description here.
Show 10 more
Informationalto_address is not checked to be a valid addressAcknowledged
The report gives no description here.
InformationalUnhandled parsing errors during query_providersAcknowledged
The report gives no description here.
InformationalUnnecessary string copies and allocations from overuse of Clone::cloneAcknowledged
The report gives no description here.
InformationalUsage of magic numbers during reward rateAcknowledged
The report gives no description here.
InformationalInconsistent documentation regarding missing validator blacklist in the AfterDelegationModified hookFixed
The report gives no description here.
InformationalIneffective unit test for the sovereign upgrade handlerFixed
The report gives no description here.
InformationalLack of context in comments explaining manual validator set managementFixed
The report gives no description here.
InformationalLack of guaranteed IBC client updates during the upgrade may cause IBC transaction failuresFixed
The report gives no description here.
InformationalPotential chain halt due to pre-blocker retrieving deleted validator’s stateFixed
The report gives no description here.
InformationalPotential confusion during shares-to-tokens comparisonFixed
The report gives no description here.
Show 2 more
InformationalRedundant code within the sovereign upgrade handler and AnteHandler setup optionsFixed
The report gives no description here.
InformationalUsage of magic numbers decreases maintainabilityFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Neutron’s security record
NeutronSecurity firm
Oak Security33 projects reviewed · 60 reports · latest May 2026
See Oak Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us