Quantstamp reviewed Zora on 17 Dec 2020: 12 findings, 0 critical; 4 marked fixed, 3 acknowledged, 5 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 1 | 1 |
| Medium | 1 | 0 | 0 |
| Low | 3 | 2 | 3 |
Users can transfer tokens via the ERC721 part of the `Media` contract and circumvent the creator fee. **Update 2021-01-06:** The Zora team notes that participants engaging in such behavior would have a reputation penalty, which would hurt their prospects as a distribution platform. They also note that the incentive to circumvent the creator fee outside the Zora market is diminished not only by the reputation penalty but also by the available liquidity in that market. They also make the valid point that disabling such transfers would hinder composition with other protocols and the movement of NFTs between a collector's wallets.
The Zora NFT market behaves differently from a standard auction in two main ways: * There is no time window wherein bids are placed; as soon as a bid meets the ask, it is accepted, potentially resulting in a lower payout to the seller. * Asks may be modified (reduction, increase, change in currency, insertion, removal), even in response to a bid. Since the term “auction” is used, some users might misunderstand the nature of the Zora market.
The clone-and-own approach involves copying and adjusting open source code at one's own discretion. From the development perspective, it is initially beneficial as it reduces the amount of effort. However, from the security perspective, it involves some risks as the code may not follow the best practices, may contain a security vulnerability, or may include intentionally or unintentionally modified upstream libraries.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (8)
236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us