Crestal Network audit

SherlockCode version: not recorded (see the report)

Audit competition · firm’s term: public audit contest

Sherlock reviewed Crestal Network (Crestal Network audit) on 14 Mar 2025: 7 findings, 0 critical; all marked fixed.

No open critical findings
Open the reportOpen Crestal Network’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings7

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium006
Low000
HighAnyone who is approving BlueprintV5 contract to spend ERC20 can get drained because Payment::payWithERC20Fixed

The report gives no description here.

MediumcreateCommonProjectIDAndDeployment Request() hardcodes request id index to 0, leading to lost requests for usersFixed

The report gives no description here.

MediumLack of access control in setWorker PublicKey() in BlueprintCore.sol which results users to lose fundsFixed

The report gives no description here.

MediumNon whitelisted user can also create agent by calling createAgentWithNFT instead of createAgentWithWhitelistUsers affecting the motive of protocol to only allow whitelisted user to create agentFixed

The report gives no description here.

MediumSignature Replay attack possible on updateWorkerDeploymentConfigWithSig() in Blueprintcore.sol which leads to users lose the fundsFixed

The report gives no description here.

MediumSignatures missing some parameters being vulnerable to attackers using them coupled with malicious parametersFixed

The report gives no description here.

MediumWorker-Induced Denial-of-Service in Deployment Requests Due to Lack of a Cancellation MechanismFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Crestal Network’s security record

Crestal Network
Audits1 audit by 1 firmLast audit Mar 2025, by Sherlock.
Critical findingsNo open critical findingsIn 1 report.
Open Crestal Network’s security record

Security firm

Sherlock

46 projects reviewed · 67 reports · latest Sep 2026

See Sherlock’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us