Flow Core Contract

Quantstamp25 Feb 2026Code version: not recorded (see the report)

Audit

Quantstamp reviewed Flow.com (Flow Core Contract) on 25 Feb 2026: 1 finding, 0 critical; it is marked fixed.

No open critical findings

Open the report Open Flow.com’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings1

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	0	0	1

LowLoose hex prefix check in `addressFromString` allows silent address misinterpretationFixed

`addressFromString()` detects the `0x` prefix by only checking the second character (`asHex[1] == "x"`), not the first. A 42-character string where the second character is "x" but the first is not "0" (e.g., "Ax...", "1x...") will have its first two characters silently stripped, producing a valid but unintended 20-byte address. ```cadence var withoutPrefix = (asHex[1] == "x" ? asHex.slice(from: 2, upTo: asHex.length) : asHex).toLower() ``` Separately, a 42-character input where `asHex[1] != "x"` passes the full string to `decodeHex()`, producing 21 bytes. The subsequent `toConstantSized<[UInt8; 20]>()` returns `nil`, and the force-unwrap (`!`) panics with a generic runtime error rather than the function's own descriptive precondition message.