AtomOne audit
Oak Security reviewed AtomOne (AtomOne audit) on 23 Apr 2026: 50 findings, 1 critical; 40 marked fixed, 10 acknowledged.
Report hosted on GitHub.
Statuses are the security firm’s own, from this report. Trustblock does not review code.
Findings50
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 1 | 7 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 9 | 32 |
CriticalDuplicate header resubmission falsely triggers misbehavior detection and freezes the Gno light clientFixed
The report gives no description here.
HighEqual-height equivocation detection is completely disabled due to using the parent block ID instead of the commit block IDFixed
The report gives no description here.
HighGenesis import doubles active governor validator sharesFixed
The report gives no description here.
HighInverted error check in staking hooks disables governor auto-deactivationFixed
The report gives no description here.
HighMinimum stake requirement for governance voting is bypassed via cosmos.gov.v1 message typesFixed
The report gives no description here.
HighNested authz MsgExec bypasses GovVoteDecorator minimum stake checkFixed
The report gives no description here.
HighProto3 CommitSig encoding cannot represent absent Gno.land precommits, preventing conversion of blocksFixed
The report gives no description here.
HighVerifyLightCommit incorrectly validates signatures by index, breaking non-adjacent header verificationFixed
The report gives no description here.
LowAsymmetric group sizes bias the Nakamoto coefficient adjustment toward decreasingFixed
The report gives no description here.
LowBankers rounding in Nakamoto bonus division can cause over-distribution and halt the chainFixed
The report gives no description here.
Show 10 more
LowcheckMisbehaviourHeader uses hardcoded default trust level instead of per-client TrustLevelFixed
The report gives no description here.
LowDelegateGovernor does not validate that the target governor existsFixed
The report gives no description here.
LowDeleteProposal does not remove QuorumCheckQueue entry, causing early termination of quorum checksFixed
The report gives no description here.
LowEditGovernor overwrites the full description instead of merging fieldsFixed
The report gives no description here.
LowEndBlocker ordering contradicts documentationFixed
The report gives no description here.
LowGenesis import panics for non-governor governance delegationsFixed
The report gives no description here.
LowGetNewMinDeposit can return an unsorted sdk.CoinsFixed
The report gives no description here.
LowGovernor existence checks mask storage and encoding errorsFixed
The report gives no description here.
LowIncorrect module name referenced in error commentFixed
The report gives no description here.
LowInitGenesis does not validate minimum self-delegation for imported governorsFixed
The report gives no description here.
Show 10 more
LowMinLearningRate nil check uses the wrong field in parameter validationFixed
The report gives no description here.
LowMisleading --from [granter] placeholder in prune-grants CLI commandFixed
The report gives no description here.
LowMissing AppVersion field in header conversion will break client updates if Gno.land populates itFixed
The report gives no description here.
LowMissing else-if in UpdateGovernorStatus causes a redundant undelegate and redelegate cycleFixed
The report gives no description here.
LowMissing MsgAnnotateProposal annotation length validationFixed
The report gives no description here.
LowMissing Use field for GovernanceDelegation query CLI commandFixed
The report gives no description here.
LowMissing validation of TargetActiveProposals allows permanent deposit ratchetFixed
The report gives no description here.
LowMsgEditGovernor.ValidateBasic missing description length validationFixed
The report gives no description here.
LowMsgUpdateParams does not validate params, allowing chain-halting parameter configurationFixed
The report gives no description here.
LowNo validation that the steering DAO and oversight DAO addresses are differentFixed
The report gives no description here.
Show 10 more
LowPanic recovery in UpdateBaseGasPrice can leave an inconsistent stateFixed
The report gives no description here.
LowParticipation EMA values not validated in genesisFixed
The report gives no description here.
LowSpelling and grammar issues across the codebaseFixed
The report gives no description here.
LowUnchecked error from GetValidator can cause a nil pointer panicFixed
The report gives no description here.
LowUnhandled collection walk errors are silently discardedFixed
The report gives no description here.
LowV4 upgrade handler sources the MinDepositRatio and GovernorStatusChangePeriod governance parameter defaults from the Cosmos SDK fork instead of the AtomOne definitionsFixed
The report gives no description here.
LowV4-to-v5 migration does not clear deprecated parameters, breaking genesis exportFixed
The report gives no description here.
LowValidateTrustLevel function is dead codeFixed
The report gives no description here.
LowVerifyLightCommit error message reports incorrect voting power thresholdFixed
The report gives no description here.
LowWrong variable in the error message for the MaximumCoefficient validationFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of AtomOne’s security record
AtomOneSecurity firm
Oak Security33 projects reviewed · 60 reports · latest May 2026
See Oak Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us