Fabstir / Marketplace
Hacken reviewed Fabstir (Fabstir / Marketplace) on 16 Mar 2026: 41 findings, 0 critical; 24 marked fixed, 12 acknowledged, 5 open.
Report hosted on hacken.io.
Trustblock does not review code.
Findings41
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 4 |
| Medium | 2 | 2 | 7 |
| Low | 3 | 10 | 13 |
HighDelegate Spending Cap Bypass via Token Selection Allows Draining Payer Funds Beyond Intended LimitsFixed
The report gives no description here.
HighProposal Fee Permanently Locked on RejectionFixed
The report gives no description here.
HighToken Pricing Assumes All Payment Tokens Have Same Decimals And PriceFixed
The report gives no description here.
HighUse of IERC20.transfer() Instead of SafeERC20.safeTransfer() in Refund PathFixed
The report gives no description here.
MediumDeactivated Model Still Usable for Sessions and Node RegistrationFixed
The report gives no description here.
MediumDispute Window Calculated From Session Start Time Instead of Last Proof SubmissionFixed
The report gives no description here.
MediumEarly Cancel Fee Applied on Depositor-Triggered TimeoutsFixed
The report gives no description here.
MediumHardcoded Private Key Exposure in Test Scripts Enables Unauthorized Account ControlFixed
The report gives no description here.
MediumMissing Access Control on verifyAndMarkComplete Enables Proof Griefing AttackFixed
The report gives no description here.
MediumproofInterval Validated as Token Count but Used as Seconds in Timeout CalculationFixed
The report gives no description here.
Show 10 more
MediumRefund Failure Prevents Host Payment and Locks Session FundsFixed
The report gives no description here.
LowDelegate Authorization Has No Spending LimitsFixed
The report gives no description here.
LowHardcoded Token Rate Limit Cannot Adapt to Future Hardware ImprovementsFixed
The report gives no description here.
LowHost Signature In submitProofOfWork() Adds No Security ValueFixed
The report gives no description here.
LowlateVotes Not Cleared on Proposal ExecutionFixed
The report gives no description here.
LowPre-Deposited Users Cannot Create Model-Specific SessionsFixed
The report gives no description here.
LowProof Verification Bypassed When ProofSystem Is Not ConfiguredFixed
The report gives no description here.
LowRedundant Function Wrapper in ProofSystemUpgradeable ContractFixed
The report gives no description here.
LowSignature Malleability Attack in ProofSystemUpgradeable ContractFixed
The report gives no description here.
LowUnfinalized Access-Control Functionality in ProofSystemUpgradeable ContractFixed
The report gives no description here.
Show 4 more
LowUnfinalized Circuits Functionality in ProofSystemUpgradeable ContractFixed
The report gives no description here.
LowUnused Functions In ProofSystemUpgradeableFixed
The report gives no description here.
LowUnused onlyRegisteredHost Modifier Contains Empty ImplementationFixed
The report gives no description here.
Lowverified Field in ProofSubmission Is Hardcoded to true — Dead StorageFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (7)
- src/ModelRegistryUpgradeable.sol
- src/NodeRegistryWithModelsUpgradeable.sol
- src/utils/ReentrancyGuardUpgradeable.sol.
- src/JobMarketplaceWithModelsUpgradeable.sol
- src/HostEarningsUpgradeable.sol
- src/interfaces/UserOperation.sol
- src/ProofSystemUpgradeable.sol
Part of Fabstir’s security record
FabstirSecurity firm
Hacken343 projects reviewed · 476 reports · latest Sep 2026
See Hacken’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us