ZkLend security review

Nethermind Security1 address on Starknet

Audit · firm’s term: security review & formal specification

Nethermind Security reviewed zkLend (ZkLend security review) on 23 May 2022: 4 findings, 0 critical; 1 marked fixed, 3 acknowledged.

No open critical findings
Open the reportOpen zkLend’s security record
Report stored on IPFS. Content hash bafybeibh5u53wgsd7dikxznxfch3hqn65xclfroenevwp7ncpmpduxz22q

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium020
Low010

Marked Best Practices or Info by the firm. Not counted as findings.

Best PracticesEmit events on contract deployment and initializationAcknowledged

The report gives no description here.

Best PracticesMissing argument validations in transfer functionsAcknowledged

The report gives no description here.

InfoMissing check for ZToken market address in add_reserve(...)Acknowledged

The report gives no description here.

Best PracticesMissing safety features in privileged address and implementation changesAcknowledged

The report gives no description here.

Best PracticesVariable naming for ZToken amounts can be unclearAcknowledged

The report gives no description here.

Best PracticesComment does not match function logicFixed

The report gives no description here.

Best PracticesMissing events emission in set_token_source(...)Fixed

The report gives no description here.

Best PracticesUnused functionsFixed

The report gives no description here.

Contracts in scope1

AddressChain
Chain: Starknet

Part of zkLend’s security record

zkLend
Audits3 audits by 2 firmsLast audit Mar 2025, by Nethermind Security.
Critical findingsNo open critical findingsAcross the 3 reports, 1 critical finding was reported. It is marked fixed by the firm that reported it.
Open zkLend’s security record

Security firm

Nethermind Security

57 projects reviewed · 81 reports · latest Sep 2026

See Nethermind Security’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us