TrustSwap / Team Finance

Hacken8 May 20261 address on Ethereum

Hacken reviewed TrustSwap (TrustSwap / Team Finance) on 8 May 2026: 19 findings, 2 critical; 18 marked fixed, 1 acknowledged.

2 critical findings, fixed

Open the report Open TrustSwap’s security record

Report hosted on hacken.io.

Trustblock does not review code.

Findings19

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	2
High	0	0	1
Medium	0	0	4
Low	0	1	11

CriticalMissing Per-Deposit Withdrawal Bound Allows Negative Balance Exploitation To Drain Locked FundsFixed

The report gives no description here.

CriticalUnbounded Withdrawal Allows Complete Drain of Staked TokensFixed

The report gives no description here.

HighMissing Fee Enforcement In Split Lock Allows Unlimited Deposit Creation At Zero CostFixed

The report gives no description here.

MediumFee Charge Logic Allows Deterministic UnderpaymentFixed

The report gives no description here.

MediumMissing Transfer Amount Verification In All Contracts Leads To Undercollateralization With Fee-On-Transfer TokensFixed

The report gives no description here.

MediumRevocation Of Vesting Schedule Seizes Already-Vested Tokens From BeneficiaryFixed

The report gives no description here.

MediumReward Over-Collection When Adding Rewards Before Pool StartFixed

The report gives no description here.

LowAbsence Of TTL Extension For Storage Leads To Recurring Restoration CostsFixed

The report gives no description here.

LowAbsent Oracle Price Staleness Validation Can Lead To Incorrect Fee CalculationFixed

The report gives no description here.

LowDuplicate Lock Token And Lock LP Token Functions Differ Only By Emitted EventFixed

The report gives no description here.

Show 8 more

LowIncorrect Error Variant In set_referral_params Leads To Ambiguous Validation ErrorsFixed

The report gives no description here.

LowIncorrect Event Namespace In Staking Admin Events May Delay Detection Of Admin ActionsFixed

The report gives no description here.

LowIncorrect Transfer Limit in Claim NFT InstructionFixed

The report gives no description here.

LowMissing Authorization Check on Vesting Claim BeneficiaryFixed

The report gives no description here.

LowMissing On-Chain Bounds Validation Of Merkle-Authenticated Leaf Parameters In VestingFixed

The report gives no description here.

LowMissing Pause Mechanism In Staking Contract Limits Incident Response CapabilityFixed

The report gives no description here.

LowUsage Of Raw Panic Instead Of Structured Contract Errors In Asset Recovery FunctionFixed

The report gives no description here.

LowVulnerable soroban-sdk Version Susceptible To Function Dispatch BypassFixed

The report gives no description here.

Contracts in scope1

Address	Chain	Source code
0xcc4304a31d09258b0029ea7fe63d032f52e44efe	Chain: Ethereum	Source code: Verified source

Part of TrustSwap’s security record

TrustSwap

Audits2 audits by 1 firmLast audit May 2026, by Hacken.

Critical findingsNo open critical findingsAcross the 2 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it.

Open TrustSwap’s security record

Security firm

Hacken

343 projects reviewed · 476 reports · latest Sep 2026

See Hacken’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.