Ninja audit
Audit · firm’s term: security audit
Oak Security reviewed Injective (Ninja audit) on 20 Jan 2023: 15 findings, 1 critical; 10 marked fixed, 5 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings15
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 2 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 3 | 9 |
CriticalFees held by spot vault are locked foreverFixed
The report gives no description here.
LowA dependency is vulnerable to two CVEsFixed
The report gives no description here.
LowCustom calls between Cosmos SDK modules and CosmWasm contractsFixed
The report gives no description here.
LowInsufficient validation of addresses in configsFixed
The report gives no description here.
LowLarge order_density could lead to the execution running out of gasFixed
The report gives no description here.
LowMessage attributes are defined and stored with type inconsistencyFixed
The report gives no description here.
LowParameter space of derivative vault config is loosely validatedFixed
The report gives no description here.
LowQuery does not implement a pagination mechanismFixed
The report gives no description here.
LowUpdating Ninja token address may cause state conflictsFixed
The report gives no description here.
LowVault contracts ownership cannot be transferredFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Injective’s security record
InjectiveSecurity firm
Oak Security33 projects reviewed · 60 reports · latest May 2026
See Oak Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us