Molecule OnChainLab Audit Report
Cyfrin reviewed Molecule (Molecule OnChainLab Audit Report) on 12 May 2026: 18 findings, 1 critical; 17 marked fixed, 1 acknowledged.
The original report was removed from its address (seen 16 Oct 2026).
Trustblock does not review code.
Findings18
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 2 |
| Medium | 0 | 0 | 4 |
| Low | 0 | 1 | 10 |
Marked Informational or Gas by the firm. Not counted as findings.
InformationalOnChainLab::fallback else branch is unreachableAcknowledged
The report gives no description here.
GasDiscarded return data from low-level .callvalue: should use inline-assembly callFixed
The report gives no description here.
InformationalLabNFT::setMintFee lacks an upper boundFixed
The report gives no description here.
InformationalMintAndCreateAccount deploy script omits msg.value; every invocation reverts post-deployFixed
The report gives no description here.
GasMoleculeOclDidRegistry::_linkDid discards _upsertDid’s return valueFixed
The report gives no description here.
InformationalMoleculeOclDidRegistry::_upsertDid produces colliding version numbers across DID rotationsFixed
The report gives no description here.
GasMoleculeOclDidRegistry::_upsertDid re-reads next.version after writing itFixed
The report gives no description here.
InformationalMoleculeOclDidRegistry::usedRequestId nullifier scope mismatch with typed-data bindingFixed
The report gives no description here.
InformationalNatSpec error in OnChainLab::initialize: setRegistry is not ’Module Registry’Fixed
The report gives no description here.
InformationalOnChainLab::execute discards ExecLib::execute return dataFixed
The report gives no description here.
Show 8 more
InformationalOnChainLab::isValidSignature return 0 instead of 0xffffffff for invalid signaturesFixed
The report gives no description here.
InformationalOnChainLab::owner returns address(0) when not on the canonical chain, silent fallbackFixed
The report gives no description here.
InformationalOnChainLabs lacks a dedicated wrapper for EntryPoint::withdrawTo, forcing owners through generic executeFixed
The report gives no description here.
GasRedundant default initialization to 0Fixed
The report gives no description here.
InformationalRootValidatorUpdated event is misleading: the root validator is never updatedFixed
The report gives no description here.
GasUnused locals and parameters in ValidationManager::_validateUserOpFixed
The report gives no description here.
InformationalUse named mapping parametersFixed
The report gives no description here.
InformationalValidationManager::invalidateNonce, validNonceFrom are dead codeFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Molecule’s security record
Security firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us