Europeum / DIDR
Hacken reviewed Europeum (Europeum / DIDR) on 11 Aug 2026: 16 findings, 0 critical; 15 marked fixed, 1 acknowledged.
Report hosted on hacken.io.
Trustblock does not review code.
Findings16
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 1 | 12 |
MediumMissing Revoked Guard in addVerificationRelationship Grants a Revoked Key Non-Revocable ControlFixed
The report gives no description here.
MediumRolling a Capability Invocation Key to a Non-secp256k1 Key Strands Identifier ControlFixed
The report gives no description here.
MediumScheduling a Future Expiry Revokes Control Immediately Instead of at the Scheduled TimeFixed
The report gives no description here.
Low[Dual Defense] rollVerificationMethod Accepts an Already-Expired capabilityInvocation Window, Locking the DID in a Single TransactionFixed
The report gives no description here.
Low[Dual Defense] rollVerificationMethod's Non-CapabilityInvocation Branch Skips the PublicKeyAlreadyInUse Guard, So Revoking the Duplicate Unbinds the Live capabilityInvocationFixed
The report gives no description here.
Low[Dual Defense] Unbounded Duration and Missing Unbind Resurrects Expired KeysFixed
The report gives no description here.
LowDead Storage Field in DidDocuments StructFixed
The report gives no description here.
LowexpireVerificationMethod Accepts a Later Expiry and Can Extend Validity Instead of Shortening ItFixed
The report gives no description here.
LowFloating PragmaFixed
The report gives no description here.
LowgetAddress Performs No secp256k1 Curve-Point ValidationFixed
The report gives no description here.
Show 5 more
LowMissing Secp256k1 Enforcement in addVerificationRelationship CapabilityInvocation Path Strands DID ControlFixed
The report gives no description here.
LowPermissionless Registration Accepts a Never-Valid Control Window Enabling Squatting and Permanent LockoutFixed
The report gives no description here.
LowrevokeController Allows Removing the Last Controller and Locking Out the DIDFixed
The report gives no description here.
LowrollVerificationMethod Sets the Relationship-Uniqueness Tuple Without the Add-Path GuardFixed
The report gives no description here.
LowStrict Control Bounds Versus Inclusive Read-View Bounds Create a Boundary AsymmetryFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (5)
- contracts/did-registry/contracts/library/ControllersLib.sol
- contracts/did-registry/contracts/DidRegistry.sol
- contracts/did-registry/contracts/UtilsLib.sol
- contracts/did-registry/contracts/library/VRelationshipsLib.sol
- contracts/did-registry/contracts/library/DidDocumentLib.sol
Part of Europeum’s security record
EuropeumSecurity firm
Hacken343 projects reviewed · 476 reports · latest Sep 2026
See Hacken’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us