Zilliqa / Zilliqa Ownership Proof
Hacken reviewed Zilliqa (Zilliqa Ownership Proof) on 9 Sep 2026: 20 findings, 0 critical; 18 marked fixed, 1 acknowledged, 1 open.
Report hosted on hacken.io.
Trustblock does not review code.
Findings20
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 0 | 8 |
| Low | 1 | 1 | 7 |
High.trim() on the BIP-39 passphrase silently derives a different master keyFixed
The report gives no description here.
HighHardcoded hardened-only derivation path locks out all standard BIP-44 walletsFixed
The report gives no description here.
HighMissing EIP-55 check and destination confirmation send the balance to a mistyped addressFixed
The report gives no description here.
MediumASCII-only mnemonic validator rejects six of the ten wordlistsFixed
The report gives no description here.
Mediumbech32 decoder in addr20 skips checksum and HRP validationFixed
The report gives no description here.
MediumMissing IL < n and childPriv != 0 checks break BIP-32 conformance in CKDHardenedFixed
The report gives no description here.
MediumMissing length validation on decoded addresses in ProofServiceFixed
The report gives no description here.
MediumMnemonic checksum validation is optional and English-only, silently skipping on non-English mnemonics or a missing dependencyFixed
The report gives no description here.
Mediumstdin is not checked for TTY before prompting, so the "hidden" mnemonic prompt can silently echo in cleartextFixed
The report gives no description here.
MediumUnconstrained newAddr and domain desynchronize the proof from the on-chain addressFixed
The report gives no description here.
Show 8 more
MediumUnnormalized U+3000 separator rejects Japanese phrases typed with a regular spaceFixed
The report gives no description here.
LowDuplicated zkey path bypasses DownloadService and is not re-verified before provingFixed
The report gives no description here.
LowLocally generated proof is not verified before the user is told to submit itFixed
The report gives no description here.
LowMislabeled xprv Input Field Invites Users to Submit Incompatible Private Key MaterialFixed
The report gives no description here.
LowMissing canonical-padding check in bech32ToBytesFixed
The report gives no description here.
LowSilent truncation in _bigIntToUint256 hides oversized values instead of erroringFixed
The report gives no description here.
LowUnconstrained hardened-index binding in CKDFinalStep allows proving ownership at any hardened index, not just 0'Fixed
The report gives no description here.
LowUnused LedgerDerive template in bip32lib.circomFixed
The report gives no description here.
Contracts in scope2
| Address | Chain | Source code |
|---|---|---|
| 0x05f4a42e251f2d52b8ed15e9fedaacfcef1fad27 | Chain: Ethereum | Source code: Verified source |
| 0xb86abcb37c3a4b64f74f59301aff131a1becc787 | Chain: BNB Chain | Source code: Verified source |
Part of Zilliqa’s security record
ZilliqaSecurity firm
Hacken343 projects reviewed · 476 reports · latest Sep 2026
See Hacken’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us