– ZIGChain audit
Oak Security reviewed ZIGChain (– ZIGChain audit) on 15 May 2026: 30 findings, 1 critical; 21 marked fixed, 9 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings30
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 1 | 7 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 8 | 13 |
CriticalPool transfer ante handler is bypassable via authz grants and CosmWasm contract executionFixed
The report gives no description here.
HighAddLiquidity returns excess deposit coins to the receiver instead of the original senderFixed
The report gives no description here.
HighDenial of service on fee withdrawal via unbounded balance iteration on factory module accountFixed
The report gives no description here.
HighDenial of service on liquidity removal via unbounded balance iteration on pool addressesFixed
The report gives no description here.
HighDEX pool funds are sendable to blocked module addresses via the receiver parameterFixed
The report gives no description here.
HighImproper error handling in OnAcknowledgementPacket causes irrecoverable silent fund lossFixed
The report gives no description here.
HighMissing ClaimDenomAdmin handler in CosmWasm message pluginFixed
The report gives no description here.
HighRecoverZig lacks module address and vesting account blocklistsFixed
The report gives no description here.
LowAttacker-controlled denomination sorting blocks legitimate fee withdrawalFixed
The report gives no description here.
LowCompounded rounding error in liquidity addition ratio calculationFixed
The report gives no description here.
Show 10 more
LowFactory MintAndSendTokens bypasses pool transfer blocking ante handlerFixed
The report gives no description here.
LowHard error in OnAcknowledgementPacket blocks acknowledgement processing for non-whitelisted channelsFixed
The report gives no description here.
LowIncomplete genesis invariant validation allowing internally inconsistent module stateFixed
The report gives no description here.
LowMisleading denomination supply metrics due to inconsistent burn and mint accountingFixed
The report gives no description here.
LowMissing rollback in SendPacket after ics4Wrapper.SendPacket failureFixed
The report gives no description here.
LowOver-privileged factory module account granting unnecessary staking authorityFixed
The report gives no description here.
LowPool UID collision possible via separator character in denomination namesFixed
The report gives no description here.
LowRate limiter middleware ordering causes incorrect rate limiting for token wrapper transfersFixed
The report gives no description here.
LowTruncation rounding in liquidity share calculation slightly favors depositorsFixed
The report gives no description here.
LowUnvalidated and unused description field in denom creation messageFixed
The report gives no description here.
Show 1 more
LowWASM custom message handlers return nil for events, data, and message responsesFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of ZIGChain’s security record
ZIGChainSecurity firm
Oak Security33 projects reviewed · 60 reports · latest May 2026
See Oak Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us