Stackup Keystore
Cantina reviewed StackUp (Stackup Keystore) on 18 Aug 2025: 10 findings, 0 critical; 9 marked fixed, 1 acknowledged.
Report hosted on cantina.xyz.
Trustblock does not review code.
Findings10
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 1 | 6 |
MediumSignature from one address can be recycled to maliciously reach thresholdFixed
The report gives no description here.
MediumSignature replay possible with shared signersFixed
The report gives no description here.
MediumWhat if a wrong rootHash is used?Fixed
The report gives no description here.
LowExcluding the chainId may cause unexpected effectsFixed
The report gives no description here.
LowFunction handleUpdates could be reenteredFixed
The report gives no description here.
LowMultisig should have minimum threshold of oneFixed
The report gives no description here.
LowUpgradeability pattern inconsistency in KeystoreAccount contractFixed
The report gives no description here.
LowUserOpMultiSigVerifier::validateData() fails with more than 256 ownersFixed
The report gives no description here.
LowUserOpMultiSigVerifier::validateData() fails with more than 256 signaturesFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of StackUp’s security record
Security firm
Cantina37 projects reviewed · 175 reports · latest Oct 2026
See Cantina’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us