Tokenize.it / Token
Hacken reviewed Tokenize.it (Tokenize.it / Token) on 17 May 2026: 23 findings, 0 critical; 22 marked fixed, 1 acknowledged.
Report hosted on hacken.io.
Trustblock does not review code.
Findings23
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 1 | 20 |
MediumInconsistent Validation of LockedUntil Enables Premature Privileged ActionsFixed
The report gives no description here.
MediumPush Based Settlement With Immutable Recipients Enables Permanent Denial Of ServiceFixed
The report gives no description here.
Low[DualDefense] CoinvestedPosition Per-Token Reference-Rate Rounding Allows Inflated Carry Withdrawals From Exit ProceedsFixed
The report gives no description here.
LowAsymmetric Parameter Update Logic Allows Immediate Price AvailabilityFixed
The report gives no description here.
LowCurrency Update Without Token Price Sync Leads To MispricingFixed
The report gives no description here.
LowGas Inefficiency Due to Redundant Boolean Equality CheckFixed
The report gives no description here.
LowLack of Event Emitting for Important State ChangesFixed
The report gives no description here.
LowLack of Exit Token Validation Allows Mismatched Contract BindingFixed
The report gives no description here.
LowMax Purchase Limit Is Applied Per Receiver Instead of Per BuyerFixed
The report gives no description here.
LowMismatched Cooldown Period Between Implementation and Invariants Breaks AssumptionsFixed
The report gives no description here.
Show 10 more
LowMissing Base Price Validation In Initialization Enables Full Profit RedirectionFixed
The report gives no description here.
LowMissing Inherited Initializer Calls in Clone ContractsFixed
The report gives no description here.
LowMissing Self-Reassignment ValidationFixed
The report gives no description here.
LowMissing State Cleanup After Fee Settings AcceptanceFixed
The report gives no description here.
LowMissing Zero-Address Validation for _owner in PayoutBase May Lead to Loss of Administrative ControlFixed
The report gives no description here.
LowPublic Function Not Used Internally Can be Marked ExternalFixed
The report gives no description here.
LowRedundant coolDownStart Assignment in activateDynamicPricingFixed
The report gives no description here.
LowRepeated Storage Reads of leadInvestors.length in a Loop ConditionFixed
The report gives no description here.
LowSingle Step Ownership Model Enables Immediate Loss Of Administrative ControlFixed
The report gives no description here.
LowToken Fee-Collector Compliance Bypass Applies Only to Mints Instead of All TransfersFixed
The report gives no description here.
Show 2 more
LowVesting.commit Overwrites Existing Commitment State, Including Revoked or Already-Revealed HashesFixed
The report gives no description here.
LowZero Price Allows Free Token Acquisition and Causes Division-by-ZeroFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (15)
- Token.sol
- Crowdinvesting.sol
- Distribution.sol
- TimeLock.sol
- Vesting.sol
- common/TokenSwapBase.sol
- FeeSettings.sol
- TokenSwap.sol
- PriceLinear.sol
- GlobalTokenExitRegistry.sol
- CoinvestedPosition.sol
- common/PayoutBase.sol
- AllowList.sol
- PrivateOffer.sol
- Exit.sol
Part of Tokenize.it’s security record
Tokenize.itSecurity firm
Hacken343 projects reviewed · 476 reports · latest Sep 2026
See Hacken’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us