Valuit / Valuit-Contracts

HackenRepository at commit 3c97c10

Audit

Hacken reviewed Valuit (Valuit-Contracts) on 24 Feb 2025: 45 findings, 0 critical; all marked fixed.

No open critical findings
Open Valuit’s security record

The original report was removed from its address (seen 3 Nov 2026).

Trustblock does not review code.

Findings45

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium006
Low0039
MediumInadequate Validation in deposit Function Leading to Potential Denial of ServiceFixed

The report gives no description here.

MediumIncorrect Order of Checks in canTransfer Leads to Potential Bypass of HoldTimeModule RestrictionsFixed

The report gives no description here.

MediumLack of Wrapper Status Validation in createWrapToken and toERC20 FunctionsFixed

The report gives no description here.

MediumMaxBalanceModule Restriction Interferes with Wrapping Process in ERC3643 Token SystemFixed

The report gives no description here.

MediumPrecision Loss in Fee Calculation for toERC20 and toERC3643 Functions Leads to Incorrect or Zero FeesFixed

The report gives no description here.

MediumStale Total Supply Data Leads to Incorrect Fee CalculationFixed

The report gives no description here.

Low`public` functions not called by the contract should be declared `external` insteadFixed

The report gives no description here.

LowCompliance Gap in ERC3643 to ERC20 Wrapping ProcessFixed

The report gives no description here.

LowConflict with ERC-1822 Slot in IdentityProxyFixed

The report gives no description here.

LowDiscrepancy Between NatSpec Documentation and Function Access Control in IdFactoryFixed

The report gives no description here.

Show 10 more
LowDouble Admin Fee Charged During Wrapping and Unwrapping of TokensFixed

The report gives no description here.

LowGas Inefficiency and Lack of Input Validation in Batch Functions of EscrowControllerFixed

The report gives no description here.

LowImproper Plug-and-Play Configuration and Arbitrary Updates in HoldTimeModuleFixed

The report gives no description here.

LowImproper Storage Gap Placement and Absence in Upgradeable ContractsFixed

The report gives no description here.

LowInconsistent Frozen Asset Accounting in Token.solFixed

The report gives no description here.

LowInconsistent Redemption Logic in redemptionAndBurn Function Leads to Incorrect Fund TransfersFixed

The report gives no description here.

LowInconsistent Use of Transfer LibrariesFixed

The report gives no description here.

LowIncorrect Handling of ERC20 Token Rescue in rescueAnyERC20Tokens FunctionFixed

The report gives no description here.

LowIncorrect Usage of msg.sender in moduleCheck Function Causes Discrepancies in Hold Time ValidationFixed

The report gives no description here.

LowInefficient Fee Calculation in settlement FunctionFixed

The report gives no description here.

Show 10 more
LowInefficient Use of Storage Variables in Multiple Functions of the Escrow ContractFixed

The report gives no description here.

LowLack of _disableInitializers() in Implementation Contracts of UUPS Compliance ModulesFixed

The report gives no description here.

LowLack of FundFactory Validation in EscrowControllerFixed

The report gives no description here.

LowLack of Wrapper Disabling Mechanism in ModularCompliance ContractFixed

The report gives no description here.

LowLimitation in IdentityRegistryStorage Preventing Recovery to Already Registered WalletsFixed

The report gives no description here.

LowMismanagement of Compliance Preset Status in MaxBalanceModule Allows Circumvention of Max Balance EnforcementFixed

The report gives no description here.

LowMissing Allowance Check in transferFrom Function of Token ContractFixed

The report gives no description here.

LowMissing Array Length Validation in Loop Structures in the Token contractFixed

The report gives no description here.

LowMissing Events in Key FunctionsFixed

The report gives no description here.

LowMissing Order Existence Check in settlement and rejectOrder FunctionsFixed

The report gives no description here.

Show 10 more
LowMissing Validation for Supply Limit in setSupplyLimit FunctionFixed

The report gives no description here.

LowMixing of Storage Variables and Events in Storage ContractsFixed

The report gives no description here.

LowNaming Errors in Function and Events NamesFixed

The report gives no description here.

LowOverwriting Parameters When Creating Funds or Equity Configurations for the Same TokenFixed

The report gives no description here.

LowRedundant Check in setHoldTime Function of HoldTimeModuleFixed

The report gives no description here.

LowRedundant Use of _proxy State Variable in FundFactory ContractFixed

The report gives no description here.

LowRepetitive Access Control Checks Across Multiple ContractsFixed

The report gives no description here.

LowRigid Admin Fee Structure Lacking Flexibility for Different Use CasesFixed

The report gives no description here.

LowThe usage of the precompile ecrecover can lead to signature mailabilityFixed

The report gives no description here.

LowUnnecessary Inheritance of OwnableUpgradeable Across Multiple ContractsFixed

The report gives no description here.

Show 5 more
LowUnrestricted AdminFee Setting Allows Excessive Fees and Potential Transaction RevertsFixed

The report gives no description here.

LowUnused and Duplicate ImportsFixed

The report gives no description here.

LowUpdating Stablecoin Addresses Can Cause Incorrect Token Transfers in Both EscrowController and Wrapper ContractsFixed

The report gives no description here.

LowUse of Mixed Floating and Strict Solidity Pragma VersionsFixed

The report gives no description here.

LowViolation of the Checks-Effects-Interactions Pattern in settlement and rejectOrder FunctionsFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (78)

  • https://github.com/valuit-official/valuit-smart-contracts/contracts/registry/interface/IIdentityRegistry.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/registry/storage/CTRStorage.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/compliance/modular/modules/AbstractModuleUpgradeable.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/proxy/IdentityRegistryStorageProxy.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/ClaimIssuer.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/registry/interface/IIdentityRegistryStorage.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/registry/storage/IRSStorage.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/proxy/ModularComplianceProxy.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/wrapper/Wrapper.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/proxy/AbstractProxy.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/Helpers/Bytes.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/interface/IIdentity.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/proxy/authority/IIAFactory.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/proxy/authority/TREXImplementationAuthority.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/compliance/modular/modules/AbstractModule.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/fund/IFund.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/registry/implementation/TrustedIssuersRegistry.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/interface/IERC735.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/compliance/modular/modules/ModuleProxy.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/fund/EquityConfig.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/interface/IERC734.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/proxy/TrustedIssuersRegistryProxy.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/interface/IImplementationAuthority.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/registry/implementation/IdentityRegistryStorage.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/compliance/modular/ModularCompliance.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/registry/storage/TIRStorage.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/proxy/IdentityProxy.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/Identity.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/escrow/Escrow.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/roles/Roles.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/factory/FundFactoryStorage.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/compliance/modular/modules/IModule.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/token/IToken.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/wrapper/WrapperStorage.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/fund/EquityConfigStorage.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/version/Version.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/fund/ITKN.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/factory/IdFactory.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/proxy/authority/ITREXImplementationAuthority.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/registry/implementation/IdentityRegistry.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/compliance/modular/modules/SupplyLimitModule.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/storage/Storage.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/fund/Fund.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/registry/implementation/ClaimTopicsRegistry.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/factory/FactoryProxy.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/fund/FundStorage.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/verifiers/Verifier.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/proxy/interface/IProxy.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/proxy/interface/IImplementationAuthority.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/compliance/modular/modules/CountryAllowModule.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/roles/AgentRole.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/fund/IFactory.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/token/VERC20.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/storage/Structs.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/factory/FundFactory.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/compliance/modular/MCStorage.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/proxy/IdentityRegistryProxy.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/registry/interface/IClaimTopicsRegistry.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/proxy/ProxyV1.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/proxy/ImplementationAuthority.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/escrow/TransferHelper.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/compliance/modular/modules/HoldTimeModule.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/factory/ITREXFactory.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/factory/IIdFactory.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/registry/interface/ITrustedIssuersRegistry.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/token/TokenStorage.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/proxy/ClaimTopicsRegistryProxy.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/factory/TREXFactory.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/proxy/authority/IAFactory.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/proxy/TokenProxy.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/compliance/modular/IModularCompliance.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/Helpers/String.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/compliance/modular/modules/MaxBalanceModule.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/registry/storage/IRStorage.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/token/Token.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/roles/AgentRoleUpgradeable.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/onchainID/interface/IClaimIssuer.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60
  • https://github.com/valuit-official/valuit-smart-contracts/contracts/escrow/EscrowStorage.sol at commit 3c97c10ab99267438e8c67aaebc46432951cbc60

Part of Valuit’s security record

Valuit
Audits1 audit by 1 firmLast audit Feb 2025, by Hacken.
Critical findingsNo open critical findingsIn 1 report.
Open Valuit’s security record

Security firm

Hacken

343 projects reviewed · 476 reports · latest Sep 2026

See Hacken’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us