BOB Staking security review

Pashov Audit Group21 Oct 2025Code version: not recorded (see the report)

Audit · firm’s term: security review

Pashov Audit Group reviewed BOB Onramp (BOB Staking security review) on 21 Oct 2025: 20 findings, 2 critical; 12 marked fixed, 8 acknowledged.

2 critical findings, fixed

Open the report Open BOB Onramp’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings20

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	2
High	0	0	2
Medium	0	1	2
Low	0	7	6

MediumInstant withdraw lets users self-fund residuals with their own penaltyAcknowledged

The report gives no description here.

LowBoost window mis-scaled dividing by TIME_UNIT not 30 daysAcknowledged

The report gives no description here.

LowExpired lock accepts new stakeAcknowledged

The report gives no description here.

LowIn _setStakingCondition() sums can exceed REWARD_RATIO_DENOMINATORAcknowledged

The report gives no description here.

LowMissing events on key settersAcknowledged

The report gives no description here.

LowMultistep division leads to loss of precisionAcknowledged

The report gives no description here.

LowResidual claim reverts on shortageAcknowledged

The report gives no description here.

LowwithdrawRewardTokens() allows excess withdrawal ignoring residualRewardBalanceAcknowledged

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of BOB Onramp’s security record

BOB Onramp

Audits4 audits by 1 firmLast audit Oct 2025, by Pashov Audit Group.

Critical findingsNo open critical findingsAcross the 4 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it.

Open BOB Onramp’s security record

Security firm

Pashov Audit Group

86 projects reviewed · 165 reports · latest Aug 2026

See Pashov Audit Group’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.