zkBob smart contracts Security Audit

ChainSecurityFiles named in the report

Audit · firm’s term: security audit

ChainSecurity reviewed zkBob (zkBob smart contracts Security Audit) on 5 Jan 2023: 11 findings, 0 critical; 7 marked fixed, 4 acknowledged.

No open critical findings
Open the reportOpen zkBob’s security record

Report hosted on chainsecurity.com.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium011
Low035
HighZkBobPool Fees Can Drain the Deposits of the UserFixed

The report gives no description here.

MediumERC20Permit.receiveWithSaltedPermit Signature Can Be Front-RunFixed

The report gives no description here.

LowAdmin Reentrancy in ERC20RecoveryFixed

The report gives no description here.

LowAvoiding Recovery by AdminFixed

The report gives no description here.

LowBobVault Uint ConversionsFixed

The report gives no description here.

LowMissing Sanity ChecksFixed

The report gives no description here.

LowNo Events on State ChangesFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (22)

  • token/ERC20MintBurn.sol
  • BobToken.sol
  • utils/Claimable.sol
  • zkbob/utils/ZkBobAccounting.sol
  • utils/Ownable.sol
  • yield/YieldConnector.sol
  • token/ERC20Recovery.sol
  • BobVault.sol
  • utils/EIP712.sol
  • token/ERC20Blocklist.sol
  • zkbob/utils/CustomABIDecoder.sol
  • yield/AAVEYieldImplementation.sol
  • zkbob/manager/MutableOperatorManager.sol
  • token/ERC677.sol
  • zkbob/utils/Parameters.sol
  • token/ERC20Permit.sol
  • utils/UniswapV3Seller.sol
  • zkbob/ZkBobPool.sol
  • utils/Sacrifice.sol
  • proxy/EIP1967Admin.sol
  • zkbob/manager/SimpleOperatorManager.sol
  • token/BaseERC20.sol

Part of zkBob’s security record

zkBob
Audits2 audits by 2 firmsLast audit Jan 2023, by Decurity.
Critical findingsNo open critical findingsAcross 2 reports.
Open zkBob’s security record

Security firm

ChainSecurity

81 projects reviewed · 286 reports · latest Sep 2026

See ChainSecurity’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us