Enso TGE audit
ABDK Consulting reviewed Enso (Enso TGE audit) on 13 Oct 2025: 45 findings, 0 critical; 17 marked fixed, 28 acknowledged.
Findings45
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 1 | 8 |
| Low | 0 | 27 | 8 |
HighThis assumes the higher bits of “to” are set to zero, which Solidity documentation explicitly says this isn’t guaranteed.Fixed
The report gives no description here.
MediumPhantom overflow is possible here, i.e.Fixed
The report gives no description here.
MediumPhantom overflow is possible here, i.e.Fixed
The report gives no description here.
MediumProcedural in EnsoStakingUpgradeable.solFixed
The report gives no description here.
MediumThe “nextPositionId” property is read from the storage twice: once here and another time inside the “nextPositionId” call.Fixed
The report gives no description here.
MediumThe name of the “isSenderChecked” argument is very confusing, as one could thing that “true” value means “sender is already checked, thus no need to check again” while actually theFixed
The report gives no description here.
MediumThe only place where this function is called is within the “_collectRewards” function, and according to this comment, this function shouldn’t only be called after collecting rewardFixed
The report gives no description here.
MediumThe same external contract is called many times inside the same transaction.Fixed
The report gives no description here.
MediumThese function are very similar.Fixed
The report gives no description here.
LowProcedural in Airdrop.solFixed
The report gives no description here.
Show 7 more
LowSuboptimal in Airdrop.solFixed
The report gives no description here.
LowSuboptimal in EnsoMint.solFixed
The report gives no description here.
LowSuboptimal in EnsoStakingUpgradeable.solFixed
The report gives no description here.
LowSuboptimal in EnsoStakingUpgradeable.solFixed
The report gives no description here.
LowThe value “validatorAddress(validatorId)” is calculated twice.Fixed
The report gives no description here.
LowThis check seems redundant, as it is anyway possible to pass a dead minter address.Fixed
The report gives no description here.
LowThis event is emitted even if nothing actually changed.Fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Enso’s security record
EnsoSecurity firm
ABDK Consulting31 projects reviewed · 64 reports · latest Jan 2026
See ABDK Consulting’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us