Nym Mixnet and Vesting Contracts audit

Oak Security27 Mar 2023Code version: not recorded (see the report)

Oak Security reviewed Nym (Nym Mixnet and Vesting Contracts audit) on 27 Mar 2023: 16 findings, 7 critical; 11 marked fixed, 5 acknowledged.

1 critical acknowledged, not fixed

Open the report Open Nym’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings16

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	1	6
High	0	1	1
Medium	0	0	0
Low	0	3	4

CriticalAn attacker can frontrun BondMixnodeOnBehalf and CreateFamilyOnBehalf messages and modify their payloadFixed

The report gives no description here.

CriticalAttackers can force orphan mixnodes to join a family without their consent in order to aggregate a large quantity of them in the same layerFixed

The report gives no description here.

CriticalKey generation for (owner, proxy) pairs could lead to collisionsFixed

The report gives no description here.

CriticalSignatures can be replayed within “on behalf” transactions in order to impersonate usersFixed

The report gives no description here.

Criticaltrack_delegation can overwrite existing delegation if more then one is processed within the same blockFixed

The report gives no description here.

CriticalUnbounded iteration in TrackUndelegation message handling could make the user unable to undelegate, which also permanently inhibits epoch advancementFixed

The report gives no description here.

HighLeaveFamily and LeaveFamilyOnBehalf messages execution could fail if a significant amount of mixnodes are members of a familyFixed

The report gives no description here.

LowContracts are not compliant with CW2 Migration specificationFixed

The report gives no description here.

Lowepochs_in_interval and epoch_duration could lead to a “division by zero” error if not correctly validatedFixed

The report gives no description here.

LowMixnet contract is not resilient to transaction reordering performed by validators, allowing validators to extract valueFixed

The report gives no description here.

Show 1 more

LowNumber of nodes in each layer is not enforced to be greater than zeroFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Nym’s security record

Nym

Audits1 audit by 1 firmLast audit Mar 2023, by Oak Security.

Critical findings1 critical acknowledged, not fixedReported in “Nym Mixnet and Vesting Contracts audit” by Oak Security, Mar 2023. The team acknowledged it.

Open Nym’s security record

Security firm

Oak Security

33 projects reviewed · 60 reports · latest May 2026

See Oak Security’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.