ZIGChain audit
Oak Security reviewed ZIGChain (ZIGChain audit) on 25 Aug 2025: 23 findings, 2 critical; 21 marked fixed, 2 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings23
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 6 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 2 | 13 |
CriticalIncorrect token amount can be added to the pool reservesFixed
The report gives no description here.
CriticalMalicious chains can send IBC packets to steal funds from the tokenwrapper moduleFixed
The report gives no description here.
HighBurning tokens does not increase minting capacityFixed
The report gives no description here.
HighDisabling the tokenwrapper module prevents IBC packets from being transferredFixed
The report gives no description here.
HighFees are not incurred during MsgSwapExactOutFixed
The report gives no description here.
HighIncorrect token refund mechanism may result in users receiving the wrong tokensFixed
The report gives no description here.
HighInsufficient uzig coins in the module balance may cause IBC incoming transfers to failFixed
The report gives no description here.
HighPacket Forward Middleware (PFM) is not implementedFixed
The report gives no description here.
LowDenomAuth validation function incorrectly rejects empty admin stringsFixed
The report gives no description here.
LowImbalanced liquidity deposits can lead to immediate lossFixed
The report gives no description here.
Show 10 more
LowIncomplete GenesisState validation in the tokenwrapper module may lead to an invalid stateFixed
The report gives no description here.
LowIncomplete validation in the Pool function may allow invalid addressesFixed
The report gives no description here.
LowIncorrect pagination handling in DenomsByAdmin may lead to inaccurate resultsFixed
The report gives no description here.
LowIncorrect permission handling denies metadata access to bank adminsFixed
The report gives no description here.
LowInput string modification before validation violates best practicesFixed
The report gives no description here.
LowInsecure default keyring backendFixed
The report gives no description here.
LowInsufficient validation of CreateFeeDenom in UpdateParams may prevent denom creationFixed
The report gives no description here.
LowLack of cross-validation between DenomList and DenomAuthList may lead to an invalid stateFixed
The report gives no description here.
LowMissing MINIMAL_LIQUIDITY lock when minting first depositor share tokensFixed
The report gives no description here.
LowMissing upper bound check on decimalDifferenceFixed
The report gives no description here.
Show 1 more
LowOverwriting fields in ValidateBasic will not persist during actual executionFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of ZIGChain’s security record
ZIGChainSecurity firm
Oak Security33 projects reviewed · 60 reports · latest May 2026
See Oak Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us