AirSwap security record
As of 22 Oct 2026, AirSwap has 7 audit reports by 2 security firms on Trustblock; the latest is by PeckShield, dated 23 Apr 2024. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits7
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| AirSwap Protocol: AirSwap audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| AirSwap Protocol: AirSwap audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| AirSwap Protocol: AirSwap audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| AirSwap Protocol: AirSwap audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| AirSwap Protocol: AirSwap audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| AirSwap Protocol: AirSwap audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Airswap | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings17
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 1 | 0 | 2 |
| Low | 2 | 1 | 10 |
HighFunds may be locked if `setRuleAndIntent` is called multiple timesAirswap · Quantstamp · 20 Jan 2020Fixed
The function `Delegate.setRuleAndIntent` sets the stake of the delegate owner in the `Indexer` contract by transferring staking tokens from the user to the indexer, through the `Delegate` contract. However, if the function is called a second time, the underlying `Indexer.setIntent` will only transfer a partial amount of the total transferred tokens (i.e., the delta of the previously set intent value versus the currently set intent value). Since the behavior of the `Delegate` and the `Indexer` differ in this regard, tokens can become stuck in the Delegate. This is elaborated upon in issue [274](https://github.com/airswap/airswap-protocols/issues/274).
Open the reportMediumCentralization of PowerAirswap · Quantstamp · 20 Jan 2020Fixed
Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. However, this centralization of power needs to be made clear to the users, especially depending on the level of privilege the contract allows to the owner. In particular, the owner may `selfdestruct` the contract locking funds forever. Since the `killContract()` function does not send any of the transferred tokens out of the contract, all tokens will remain permanently locked in the contract if not previously removed by users. The platform can censor transaction via `unsetIntentForUser()`: whenever an intent is set, the owner can just unset it. It is also not easy to see if it is the owners who did this, as the event emitted is the same. The owner may also permanently pause the contract locking funds.
Open the reportMediumInteger arithmetic may cause incorrect pricing logicAirswap · Quantstamp · 20 Jan 2020Fixed
On L233 and L290, we have the following two conditions that relate sender and signer order amounts: * L233 (Equation "A"): `order.sender.param == order.signer.param.mul(10 ** rule.priceExp).div(rule.priceCoef)` * L290 (Equation "B"): `signerParam = senderParam.mul(rule.priceCoef).div(10 ** rule.priceExp);` Due to integer arithmetic truncation issues, these two equations may not relate as expected. Consider the case where: * rule.priceExp = 2 * rule.priceCoef = 3 For Equation B, when senderParam = 90, we obtain `signerParam = 90 * 3 // 100 = 2` due to integer truncation. However, when plugging back into Equation A, we obtain `2 * 100 // 3 = 66` (which doesn't equal the expected value of 90`. This means that if the signerParam is calculated by the logic in Equation B, it would not pass the requirement of Equation A.
Open the reportLowRepeated available() Calculation Avoidance in StakingAirSwap Protocol: AirSwap audit · PeckShield · 23 Apr 2024Fixed
The report gives no description here.
Open the reportLowRepeated available() Calculation Avoidance in StakingAirSwap Protocol: AirSwap audit · PeckShield · 30 Jan 2024Fixed
The report gives no description here.
Open the reportLowImproved Order Validation Logic in SwapERC20AirSwap Protocol: AirSwap audit · PeckShield · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowAccommodation of Non-ERC20-Compliant TokensAirSwap Protocol: AirSwap audit · PeckShield · 15 Feb 2022Fixed
The report gives no description here.
Open the reportLowProper Allowance Reset For Old Staking ContractsAirSwap Protocol: AirSwap audit · PeckShield · 15 Feb 2022Fixed
The report gives no description here.
Open the reportLowRemoval of Unused State/CodeAirSwap Protocol: AirSwap audit · PeckShield · 15 Feb 2022Fixed
The report gives no description here.
Open the reportLow`isValid()` does not check that the `validator` contract is correctAirswap · Quantstamp · 20 Jan 2020Fixed
While the `Swap` contract ensures that an `Order` is correctly formatted and properly signed in the `isValid()` function, it does not check that the intended `Swap` contract, as denoted by the `Order.signature.validator` field, corresponds to the correct `Swap` contract. If a sender/signer participates with multiple swap contracts, replay attacks may be possible by re-submitting the order.
Open the reportShow 3 more
Low`transferFrom()` success should not be checked by querying token balancesAirswap · Quantstamp · 20 Jan 2020Fixed
On L349: `require(initialBalance.sub(param) == INRERC20(token).balanceOf(from), "TRANSFER_FAILED");` is a dangerous equality. Although this will hold for most ERC20 tokens, the specification does not guarantee that the external ERC20 contract will adhere to this condition. For example, the token could mint or burn tokens upon a `transfer()` for various reasons.
Open the reportLowReturn values of ERC20 function calls are not checkedAirswap · Quantstamp · 20 Jan 2020Fixed
On L346 of `Swap.sol`, `ERC20.transferFrom()` is expected to return a boolean value indicating success. Although the `INRERC20` is used here, the underlying contract is most likely an `ERC20` token, and therefore its return value should be checked for success.
Open the reportLowUnchecked Return ValueAirswap · Quantstamp · 20 Jan 2020Fixed
Most functions will return a `true` or `false` value upon success. Some functions, like `send()`, are more crucial to check than others. It's important to ensure that every necessary function is checked. On L151 of `Wrapper`, the external `call.value()` is not checked for success, which may cause ether transfers to the user to fail. A similar issue exists for the `transfer()` on L127 of `Wrapper`, and L340 of `Swap`.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="airswap"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us