Alchemy Light Account

QuantstampRepository at commit aa8196b

Audit

Quantstamp reviewed Alchemy ERC (Alchemy Light Account) on 27 Sep 2023: 7 findings, 0 critical; 2 marked fixed, 3 acknowledged, 2 open.

No open critical findings
Open the reportOpen Alchemy ERC’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings7

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low232
LowImprovements for the `CustomSlotInitializable` ContractFixed

A recent version of OpenZeppelin's `Initializable` contract introduced an update to the definition of the `InitializableStorage` structure. The `_initialized` field was modified to be of type `uint64`. As a result, contracts inheriting from `Initializable` can now be initialized or re-initialized up to a maximum of `2 ** 64` times. However, the `CustomSlotInitializable` contract currently defines the `_initialized` field as type `uint8`, resulting in a discrepancy with OpenZeppelin's contract implementation.

LowMissing Input ValidationFixed

It is important to validate inputs, even if they only come from trusted addresses, to avoid human error. Here is a non-exhaustive list of input validation checks that should be added: 1. `LightAccount._transferOwnership()` should check that `newOwner != oldOwner`. 2. `LightAccount._initialize()` should check that `anOwner` is not the zero address.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (3)

  • https://github.com/alchemyplatform/light-account/src/CustomSlotInitializable.sol at commit aa8196bf925c32aa3fe48b8f582ce399d0ffd73a
  • https://github.com/alchemyplatform/light-account/src/LightAccount.sol at commit aa8196bf925c32aa3fe48b8f582ce399d0ffd73a
  • https://github.com/alchemyplatform/light-account/src/LightAccountFactory.sol at commit aa8196bf925c32aa3fe48b8f582ce399d0ffd73a

Part of Alchemy ERC’s security record

Alchemy ERC
Audits6 audits by 1 firmLast audit May 2025, by Quantstamp.
Critical findingsNo open critical findingsAcross 6 reports.
Open Alchemy ERC’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us