Stackup Keystore
Cantina reviewed StackUp (Stackup Keystore) on 18 Aug 2025: 10 findings, 0 critical; 9 marked fixed, 1 acknowledged.
Report hosted on cantina.xyz.
Trustblock does not review code.
Findings10
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 1 | 6 |
Marked Gas Optimization or Informational by the firm. Not counted as findings.
Gas OptimizationCache read directly after writeAcknowledged
The report gives no description here.
InformationalDifferent proof type used in registerNode()Acknowledged
The report gives no description here.
InformationalMissing short-circuit in dual signature verificationAcknowledged
The report gives no description here.
InformationalPossible reverts in loop of handleUpdates()Acknowledged
The report gives no description here.
Informationalsd.index could be too largeAcknowledged
The report gives no description here.
InformationalUnnecessary signature validations when signature count is below thresholdAcknowledged
The report gives no description here.
Gas OptimizationValue could already be in the cacheAcknowledged
The report gives no description here.
Informational20 could be a constantFixed
The report gives no description here.
InformationalAdding new verifiers has to be controlledFixed
The report gives no description here.
Gas OptimizationArray lenght in for loop is inefficientFixed
The report gives no description here.
Show 10 more
InformationalBad actor could hide a malicious configuration in the Merkle treeFixed
The report gives no description here.
InformationalCache mechanism not documented in specificationFixed
The report gives no description here.
InformationalConversion to bytes not obviousFixed
The report gives no description here.
InformationalDifference between spec and codeFixed
The report gives no description here.
InformationalFunction getRegisteredNode() could be simplifiedFixed
The report gives no description here.
InformationalFunction name of _validateNode doesnt cover its functionalityFixed
The report gives no description here.
InformationalNative Solidity slicing can be usedFixed
The report gives no description here.
InformationalNFTs can't be stored in KeystoreAccountFixed
The report gives no description here.
InformationalPermanent stake and configuration of timeFixed
The report gives no description here.
InformationalPublic variable starts with _Fixed
The report gives no description here.
Show 10 more
InformationalrefHash might not be uniqueFixed
The report gives no description here.
InformationalReplayability as default should be explicitly documentedFixed
The report gives no description here.
InformationalSmart account implementations must implement signature replay protectionFixed
The report gives no description here.
InformationalString based errorFixed
The report gives no description here.
InformationalUnderspecified data parameter in verifier contractsFixed
The report gives no description here.
InformationalUnnecessary elseFixed
The report gives no description here.
InformationalUse named parameters for nested mappingsFixed
The report gives no description here.
Gas OptimizationverifyCalldata() can be usedFixed
The report gives no description here.
InformationalWebAuthn verifiers implicitly assume deployment of P256 signature validators in current chainFixed
The report gives no description here.
InformationalWhat if a roothash update fails on one of the chains?Fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of StackUp’s security record
Security firm
Cantina37 projects reviewed · 175 reports · latest Oct 2026
See Cantina’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us