Propeller Heads Turbine
Audit · firm’s term: Security Assessment
Trail of Bits reviewed Propeller Heads (Propeller Heads Turbine) on 31 Mar 2026: 13 findings, 0 critical; 11 marked fixed, 2 open.
Report hosted on GitHub.
Trustblock does not review code.
Findings21
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 2 | 0 | 4 |
| Low | 0 | 0 | 4 |
HighPotential integer overflow in function scale_up_inputFixed
The report gives no description here.
HighUnable to safely change hook addressFixed
The report gives no description here.
HighUnbounded intent array enables denial of service of settlement systemFixed
The report gives no description here.
MediumAuthentication credentials leak when transmitted over unencrypted HTTPFixed
The report gives no description here.
MediumInsufficient pre-execution validation enables single-user actions to cause batch settlement failuresFixed
The report gives no description here.
MediumInvalid bit-length comparison in reduce_precisionFixed
The report gives no description here.
MediumNonstandard ERC-20 tokens cause swap failures due to unsafe transfer checksFixed
The report gives no description here.
LowECDSA signature malleabilityFixed
The report gives no description here.
LowMissing validation of user balance vector lengthFixed
The report gives no description here.
LowSIWE message version field is not validatedFixed
The report gives no description here.
Show 1 more
Lowu256_to_naive_datetime can produce values before UNIX epochFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Propeller Heads’s security record
Propeller HeadsSecurity firm
Trail of Bits29 projects reviewed · 47 reports · latest Sep 2026
See Trail of Bits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us