Molecule OnChainLab Audit Report
Cyfrin reviewed Molecule (Molecule OnChainLab Audit Report) on 12 May 2026: 18 findings, 1 critical; 17 marked fixed, 1 acknowledged.
The original report was removed from its address (seen 16 Oct 2026).
Trustblock does not review code.
Findings18
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 2 |
| Medium | 0 | 0 | 4 |
| Low | 0 | 1 | 10 |
CriticalOnChainLab::executeFromExecutor pre-listing module backdoor bypasses marketplace anti-fraud surfacesFixed
The report gives no description here.
HighRootValidator::onInstall permissionless and lacks self-bindingFixed
The report gives no description here.
HighRootValidator::onUninstall lacks access control, permanently bricking the OCL via attested modulesFixed
The report gives no description here.
MediumMissing Initialization Guard Allows Uninitialized OnChainLab Wallets to Be Configured and Used Outside Factory’s Trusted SetupFixed
The report gives no description here.
MediumOnChainLab::fallback CALLTYPE_DELEGATECALL module survives NFT transfer, allowing arbitrary OCL storage rewrites and ETH drain by the new ownerFixed
The report gives no description here.
MediumOnChainLab::isValidSignature raw-hash fallback enables same-chain cross-account ERC-1271 replayFixed
The report gives no description here.
MediumOnchainLab::uninstallModule allows uninstalling Executors that are not installed, breaking EIP-7579Fixed
The report gives no description here.
LowERC7484Registry::revoke allows revoking an already revoked attestationFixed
The report gives no description here.
LowLabNFT::transferFrom, mint bypass circular-ownership invariantFixed
The report gives no description here.
LowMissing input validation in admin setters across OdfCoAttestVerifier, MoleculeOclDidRegistry, LabNFTFixed
The report gives no description here.
Show 7 more
LowMoleculeOclDidRegistry::setRelayer accepts arbitrary oldRelayer unverifiedFixed
The report gives no description here.
LowOclDerivationConfig::setFactory missing one-shot guard, asymmetric with sister settersFixed
The report gives no description here.
LowOnChainLab::isModuleInstalled is not checking RootValidatorFixed
The report gives no description here.
LowOnChainLabFactory::initializeAccount doesn’t check the existence of the tokenFixed
The report gives no description here.
LowSelectorManager::_installSelector overwrite=true skips onUninstall on displaced moduleFixed
The report gives no description here.
LowStuck ETH on OnChainLabRouter and OnChainLab implementation: payable surfaces with no recoveryFixed
The report gives no description here.
LowUpgrade-time storage and EIP-712 layout hazards in OnChainLab, LabNFT, MoleculeOclDidRegistryFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Molecule’s security record
Security firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us