Syndicate Stage 1A audit
Audit · firm’s term: security audit
Oak Security reviewed Syndicate (Syndicate Stage 1A audit) on 9 Sep 2025: 19 findings, 1 critical; 11 marked fixed, 8 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings19
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 3 | 4 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 5 | 6 |
CriticalSilent loss via unvalidated zlib header in event parsingFixed
The report gives no description here.
HighPrivate key stored as plain string in submit_proof_to_chain CLI handlerFixed
The report gives no description here.
HighShared TransactOpts instance may cause nonce reuse and transaction failuresFixed
The report gives no description here.
HighStatic fee cap ignores chain unitsFixed
The report gives no description here.
HighUnsafe RPC buffer and message sizeFixed
The report gives no description here.
LowContainers running as root with full capabilitiesFixed
The report gives no description here.
LowIncomplete denial of SMTP traffic in firewall ruleFixed
The report gives no description here.
LowInvalid enable_private_nodes field in cluster_autoscaling blockFixed
The report gives no description here.
Lowparse_address accepts empty inputFixed
The report gives no description here.
LowService account tokens automatically mounted without RBAC restrictionsFixed
The report gives no description here.
Show 1 more
LowUnderlying decode error is silenced during transaction serializationFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Syndicate’s security record
SyndicateSecurity firm
Oak Security33 projects reviewed · 60 reports · latest May 2026
See Oak Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us