ZIGChain Reward Contract audit
Oak Security reviewed ZIGChain (ZIGChain Reward Contract audit) on 11 Nov 2025: 16 findings, 2 critical; 14 marked fixed, 2 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings16
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 4 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 2 | 8 |
CriticalIncorrect decimal calculations in token amount validationsFixed
The report gives no description here.
CriticalUsers can claim past their allowed_amount via cumulative cap bypassFixed
The report gives no description here.
HighIncorrect address validation in setRewards allows registration to arbitrary EVM walletsFixed
The report gives no description here.
HighMissing contract address validation in claim event parsing allows spoofed database entriesFixed
The report gives no description here.
HighMissing ValidationPipe and class-transformer enables unvalidated input and injection attacksFixed
The report gives no description here.
HighsetRewards lacks anti-spam mechanismFixed
The report gives no description here.
LowCase-insensitive address check allows duplicate reward registrationsFixed
The report gives no description here.
LowInsufficient validation of reward token denominationFixed
The report gives no description here.
LowLack of API rate limitingFixed
The report gives no description here.
LowLack of input validation in multiple instancesFixed
The report gives no description here.
Show 4 more
LowMissing rate limiting creates documentation inconsistencyFixed
The report gives no description here.
LowMissing validation in admin change allows setting invalid or inaccessible admin addressesFixed
The report gives no description here.
LowMissing validation of ZigWallet signer enables reward registration to arbitrary addressesFixed
The report gives no description here.
LowToken denomination updates invalidate existing claim recordsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of ZIGChain’s security record
ZIGChainSecurity firm
Oak Security33 projects reviewed · 60 reports · latest May 2026
See Oak Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us