ZIGChain audit
Oak Security reviewed ZIGChain (ZIGChain audit) on 25 Aug 2025: 23 findings, 2 critical; 21 marked fixed, 2 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings23
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 6 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 2 | 13 |
Marked Informational by the firm. Not counted as findings.
InformationalAdministrative operations lack event emissionFixed
The report gives no description here.
InformationalCommented security logic creates code confusion and maintenance issuesFixed
The report gives no description here.
InformationalDeviation from specifications in BurnTokens may result in unauthorized burningFixed
The report gives no description here.
InformationalDocumentation incorrectly lists allowed characters in subdenomsFixed
The report gives no description here.
InformationalError events emitted for non-error cases may cause confusionFixed
The report gives no description here.
InformationalError handling can be improved using the %w formatterFixed
The report gives no description here.
InformationalError when withdrawing validator commission during export is ignoredFixed
The report gives no description here.
InformationalHardcoded pool UID string construction reduces maintainabilityFixed
The report gives no description here.
InformationalIncorrect base and quote values returned after liquidity removalFixed
The report gives no description here.
InformationalIncorrect comments and unused types may cause confusionFixed
The report gives no description here.
Show 10 more
InformationalIncorrect use of SignerCheck may cause confusionFixed
The report gives no description here.
InformationalInsufficient validation in ValidateBasic may lead to panicFixed
The report gives no description here.
InformationalMagic numbers used for pool formula validationFixed
The report gives no description here.
InformationalMiscellaneous commentsFixed
The report gives no description here.
InformationalMisleading error messages and commentsFixed
The report gives no description here.
InformationalMissing denom MaxSupply check may lead to incorrect statesFixed
The report gives no description here.
InformationalMissing underflow protection in the token burned amount calculationFixed
The report gives no description here.
InformationalOne-step operator and admin transfer may lead to lost admin privilegesFixed
The report gives no description here.
InformationalOver-protective validations reduce code clarityFixed
The report gives no description here.
InformationalPool removal message is not implementedFixed
The report gives no description here.
Show 10 more
InformationalPossibility to bypass fees by swapping very low amountsFixed
The report gives no description here.
InformationalPotential division by zero during token balance calculationFixed
The report gives no description here.
InformationalPotential non-unique pool UIDs due to denom separator collisionFixed
The report gives no description here.
InformationalPresence of debugging artifact in production codeFixed
The report gives no description here.
InformationalSwapped parameters in denom validation error messagesFixed
The report gives no description here.
InformationalToken wrapping rejects amounts that convert to zeroFixed
The report gives no description here.
InformationalUnclear “invalid” state variable values in DefaultGenesisFixed
The report gives no description here.
InformationalUnnecessary metadata validation may cause confusionFixed
The report gives no description here.
InformationalUnnecessary scaleFactor implementation reduces calculation precisionFixed
The report gives no description here.
InformationalUnused functions and errors implemented in the codebaseFixed
The report gives no description here.
Show 3 more
InformationalUnused governance authority for module parametersFixed
The report gives no description here.
InformationalUnused ibcv2TransferStack initialization may cause confusionFixed
The report gives no description here.
InformationalUse of magic string for factory denom delimiter reduces maintainabilityFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of ZIGChain’s security record
ZIGChainSecurity firm
Oak Security33 projects reviewed · 60 reports · latest May 2026
See Oak Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us