Nomad
Quantstamp reviewed Nomad on 11 May 2022: 40 findings, 0 critical; 10 marked fixed, 24 acknowledged, 6 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings40
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 2 | 0 | 4 |
| Low | 4 | 24 | 5 |
MediumLong Queues Can Lead To Denial Of ServiceOpen
Whenever the `update` method in the `Home` contract is called, it will validate if the queue contains the new root. However, the queue `contains` method does a linear scan of all the items in the queue. If the root has not been updated in a long time (either mistakenly or maliciously), the queue might have too many items, causing the `contains` method to throw an `Out of Gas` exception.
MediumWatcher Availability ConcernOpen
Nomad architecture assumes the liveness of the watcher running on top of it to secure the Dapp running on top of it. We need the watcher to unroll from the replica within 30 minutes. Therefore, the availability of the watcher is critical. The current deployment is only configured with a single watcher, which concerns the availability of any hardware incident that occurs.
LowAbusing UnderflowOpen
The `Encoding.sol:L52` abuses underflow to run the for-loop. The looping variable `i` starts from 15 and decreases one by one until it gets underflow and becomes 255 to break the for-loop. The underflow mechanism will work for solidity versions before 0.8.0 as solidity 8 introduces the safe math check into the run time. Nonetheless, the `pragma` definition of the contract is `>=0.6.11`, which means it can potentially be deployed with a version higher than 0.8.0.
LowBridgeRouter Must Be The Owner Of The TokenRegistry To WorkOpen
During its operation, the `BridgeRouter` contract calls the `ensureLocalToken` and `enrollCustom` on the `TokenRegistry` contract. However, these methods can only be called by the owner of the contract. In other words, the `BridgeRouter` can only work if it's the owner of the `TokenRegistry` contract.
LowContracts Might Not Be Transferred To Rightful OwnerOpen
Contracts inheriting from `Ownable` or `OwnableUpgradeable` will have the address that deployed the contract as the owner. If the deployment script does not change the ownership right away, the deployment address will keep ownership (along with all its privileges) instead of the rightful owner (like governance).
LowPossible To Renounce OwnershipOpen
All the contracts that extend from `Ownable` or `OwnableUpgradeable` inherit a method called `renounceOwnership`. The owner of the contract can use this method to give up their ownership, thereby leaving the contract without an owner. If that were to happen, it would not be possible to perform any owner-specific functionality on that contract any more.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (66)
- Nomad/monrepo/packages/contracts-bridge/contracts/TokenRegistry.sol
- Nomad/monrepo/packages/local-environment/tests/utils/token/contract/IERC20.sol
- Nomad/monrepo/packages/contracts-core/contracts/UpdaterManager.sol
- Nomad/monrepo/packages/contracts-router/contracts/XAppConnectionClient.sol
- Nomad/monrepo/packages/contracts-bridge/contracts/BridgeMessage.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/TestRecipient.sol
- Nomad/monrepo/packages/contracts-bridge/contracts/Encoding.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/TestMerkle.sol
- Nomad/zodiac/contracts/test/Imports.sol
- Nomad/monrepo/packages/contracts-bridge/contracts/test/TestBridgeRouter.sol
- Nomad/monrepo/packages/contracts-core/contracts/XAppConnectionManager.sol
- Nomad/monrepo/packages/local-environment/tests/utils/token/contract/Token.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/MysteryMathV1.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/bad-recipient/BadRecipient2.sol
- Nomad/monrepo/packages/contracts-core/contracts/libs/Message.sol
- Nomad/monrepo/packages/contracts-core/contracts/upgrade/UpgradeBeaconController.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/TestMessage.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/TestCommon.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/bad-recipient/BadRecipient6.sol
- Nomad/monrepo/packages/contracts-core/contracts/interfaces/IMessageRecipient.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/TestHome.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/TestGovernanceMessage.sol
- Nomad/monrepo/packages/contracts-bridge/contracts/interfaces/IBridgeToken.sol
- Nomad/monrepo/packages/contracts-core/contracts/libs/TypeCasts.sol
- Nomad/monrepo/packages/contracts-core/contracts/interfaces/IUpdaterManager.sol
- Nomad/monrepo/packages/contracts-bridge/contracts/test/MockCore.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/bad-recipient/BadRecipientHandle.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/bad-recipient/BadRecipient3.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/bad-recipient/BadRecipient5.sol
- Nomad/monrepo/packages/contracts-core/contracts/Queue.sol
- Nomad/monrepo/packages/contracts-bridge/contracts/BridgeToken.sol
- Nomad/zodiac/contracts/test/TestAvatar.sol
- Nomad/monrepo/packages/contracts-core/contracts/Home.sol
- Nomad/monrepo/packages/contracts-core/contracts/upgrade/UpgradeBeaconProxy.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/MysteryMath.sol
- Nomad/zodiac/contracts/test/Mock.sol
- Nomad/monrepo/packages/contracts-bridge/contracts/test/TestBridgeMessage.sol
- Nomad/monrepo/packages/contracts-core/contracts/Version0.sol
- Nomad/monrepo/packages/contracts-bridge/contracts/vendored/OZERC20.sol
- Nomad/monrepo/packages/contracts-core/contracts/libs/Queue.sol
- Nomad/monrepo/packages/contracts-core/contracts/Replica.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/TestQueue.sol
- Nomad/monrepo/packages/local-environment/tests/utils/token/contract/ERC20.sol
- Nomad/zodiac/contracts/test/TestFactory.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/TestReplica.sol
- Nomad/monrepo/packages/contracts-bridge/contracts/test/MockWeth.sol
- Nomad/monrepo/packages/contracts-core/contracts/libs/Merkle.sol
- Nomad/monrepo/packages/contracts-router/contracts/Router.sol
- Nomad/monrepo/packages/contracts-bridge/contracts/interfaces/ITokenRegistry.sol
- Nomad/monrepo/packages/contracts-core/contracts/Merkle.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/TestXAppConnectionManager.sol
- Nomad/zodiac/contracts/GnomadModule.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/TestGovernanceRouter.sol
- Nomad/monrepo/packages/contracts-core/contracts/NomadBase.sol
- Nomad/monrepo/packages/contracts-core/contracts/governance/GovernanceRouter.sol
- Nomad/zodiac/contracts/test/MockConnectionManager.sol
- Nomad/monrepo/packages/contracts-core/contracts/upgrade/UpgradeBeacon.sol
- Nomad/monrepo/packages/contracts-bridge/contracts/test/TestEncoding.sol
- Nomad/monrepo/packages/contracts-bridge/contracts/ETHHelper.sol
- Nomad/monrepo/packages/contracts-core/contracts/governance/GovernanceMessage.sol
- Nomad/monrepo/packages/contracts-bridge/contracts/BridgeRouter.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/bad-recipient/BadRecipient4.sol
- Nomad/monrepo/packages/contracts-bridge/contracts/interfaces/IWeth.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/bad-recipient/BadRecipient1.sol
- Nomad/monrepo/packages/contracts-core/contracts/test/MysteryMathV2.sol
- Nomad/monrepo/packages/local-environment/tests/utils/token/contract/Context.sol
Part of Nomad’s security record
NomadSecurity firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us