Zora

QuantstampFiles named in the report

Quantstamp reviewed Zora on 17 Dec 2020: 12 findings, 0 critical; 4 marked fixed, 3 acknowledged, 5 open.

No open critical findings
Open the reportOpen Zora’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings12

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High111
Medium100
Low323
HighERC721 Transfers are EnabledAcknowledged

Users can transfer tokens via the ERC721 part of the `Media` contract and circumvent the creator fee. **Update 2021-01-06:** The Zora team notes that participants engaging in such behavior would have a reputation penalty, which would hurt their prospects as a distribution platform. They also note that the incentive to circumvent the creator fee outside the Zora market is diminished not only by the reputation penalty but also by the available liquidity in that market. They also make the valid point that disabling such transfers would hinder composition with other protocols and the movement of NFTs between a collector's wallets.

LowAuction System Behaves Differently from a Standard AuctionAcknowledged

The Zora NFT market behaves differently from a standard auction in two main ways: * There is no time window wherein bids are placed; as soon as a bid meets the ask, it is accepted, potentially resulting in a lower payout to the seller. * Asks may be modified (reduction, increase, change in currency, insertion, removal), even in response to a bid. Since the term “auction” is used, some users might misunderstand the nature of the Zora market.

LowClone-and-OwnAcknowledged

The clone-and-own approach involves copying and adjusting open source code at one's own discretion. From the development perspective, it is initially beneficial as it reduces the amount of effort. However, from the security perspective, it involves some risks as the code may not follow the best practices, may contain a security vulnerability, or may include intentionally or unintentionally modified upstream libraries.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (8)

  • contracts/interfaces/IMarket.sol
  • contracts/ERC721Burnable.sol
  • contracts/ERC721.sol
  • contracts/Math.sol
  • contracts/Decimal.sol
  • contracts/Market.sol
  • contracts/interfaces/IMedia.sol
  • contracts/Media.sol

Part of Zora’s security record

Zora
Audits1 audit by 1 firmLast audit Dec 2020, by Quantstamp.
Critical findingsNo open critical findingsIn 1 report.
Open Zora’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us