Forta Protocol Audit

OpenZeppelinFiles named in the report

Audit · firm’s term: audit

OpenZeppelin reviewed Forta (Forta Protocol Audit) on 8 Jun 2022: 21 findings, 0 critical; 17 marked fixed, 4 open.

No open critical findings
Open the reportOpen Forta’s security record

Report hosted on blog.openzeppelin.com.

Trustblock does not review code.

Findings21

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium205
Low2011
HighMalicious user can register a scanner under any ownerFixed

The report gives no description here.

Medium__gap missing in upgradeable contractsFixed

The report gives no description here.

MediumL2 tokens could get stuckFixed

The report gives no description here.

MediumSlashing process could be revertedFixed

The report gives no description here.

MediumStaked funds might get soft-stuckFixed

The report gives no description here.

MediumUnclear initialization of inherited contractsFixed

The report gives no description here.

LowAdd information in _emitHook callsFixed

The report gives no description here.

LowDeviation from specificationsFixed

The report gives no description here.

LowImplement a remove-whitelist functionalityFixed

The report gives no description here.

LowImplicit castingFixed

The report gives no description here.

Show 7 more
LowIncomplete interfacesFixed

The report gives no description here.

LowInconsistent slot size for upgradesFixed

The report gives no description here.

LowMagic numbers are usedFixed

The report gives no description here.

LowPotential for hash collisions with frontrun protectionFixed

The report gives no description here.

LowReentrancy possibility due to _doSafeTransferAcceptanceCheckFixed

The report gives no description here.

LowSemantic overloadFixed

The report gives no description here.

LowTODOs and comments implying unfinished codeFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (36)

  • contracts/vesting/VestingWalletV2.sol
  • contracts/components/scanners/ScannerRegistryMetadata.sol
  • contracts/components/scanners/ScannerRegistryManaged.sol
  • contracts/components/scanners/ScannerRegistryCore.sol
  • contracts/components/staking/FortaStakingUtils.sol
  • contracts/tools/FullMath.sol
  • contracts/components/router/IRouter.sol
  • contracts/env/index.sol
  • contracts/components/metatx/Forwarder.sol
  • contracts/components/dispatch/Dispatch.sol
  • contracts/helpers/BatchRelayer.sol
  • contracts/components/scanners/ScannerNodeVersion.sol
  • contracts/tools/FrontRunningProtection.sol
  • contracts/vesting/IRootChainManager.sol
  • contracts/components/scanners/ScannerRegistry.sol
  • contracts/token/FortaCommon.sol
  • contracts/components/staking/IStakeController.sol
  • contracts/vesting/escrow/StakingEscrowFactory.sol
  • contracts/components/Roles.sol
  • contracts/components/staking/FortaStakingSubjectTypes.sol
  • contracts/token/Forta.sol
  • contracts/tools/ENSReverseRegistration.sol
  • contracts/components/router/Router.sol
  • contracts/vesting/VestingWallet.sol
  • contracts/components/staking/FortaStaking.sol
  • contracts/components/utils/ForwardedContext.sol
  • contracts/components/scanners/ScannerRegistryEnable.sol
  • contracts/tools/Distributions.sol
  • contracts/components/utils/Routed.sol
  • contracts/components/utils/StakeAware.sol
  • contracts/components/BaseComponentUpgradeable.sol
  • contracts/vesting/escrow/StakingEscrowUtils.sol
  • contracts/components/utils/AccessManaged.sol
  • contracts/token/FortaBridgedPolygon.sol
  • contracts/components/access/AccessManager.sol
  • contracts/vesting/escrow/StakingEscrow.sol

Part of Forta’s security record

Forta
Audits4 audits by 2 firmsLast audit Jan 2025, by OpenZeppelin.
Critical findingsNo open critical findingsAcross the 4 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Forta’s security record

Security firm

OpenZeppelin

67 projects reviewed · 184 reports · latest Aug 2026

See OpenZeppelin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us