Arbitrum security record
As of 24 Oct 2026, Arbitrum has 1 audit report on Trustblock, by Quantstamp, dated 4 Aug 2021. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Arbitrum Token Bridge | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings9
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 1 | 4 | 2 |
HighMissing Permission Check for Function `setBridge()`Arbitrum Token Bridge · Quantstamp · 4 Aug 2021Fixed
There is a missing permission check for the function `setBridge`. This could be used for DDoS attacks.
Open the reportMediumERC-677 Standard Not Adhered to/Return Value UncheckedArbitrum Token Bridge · Quantstamp · 4 Aug 2021Fixed
0. `packages\arb-bridge-peripherals\contracts\tokenbridge\libraries\gateway\ArbitrumGateway.sol`: function `inboundEscrowAndCall` does not check for whether an external call to `ERC677Receiver` actually succeeds. It is part of the [ERC677 proposal](https://github.com/ethereum/EIPs/issues/677) that `onTokenTransfer` returns a boolean that signifies success or failure. There is an assumption here that `_to` necessarily implements a revert system too. It would be much better to check for return boolean of `onTokenTransfer` and revert on failure. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\libraries\ERC677Token.sol`: `transferAndCall` ignores return value of `transfer`; same for `onTokenTransfer`.
Open the reportLow[False Positive] Function `initialize()` Not ProtectedArbitrum Token Bridge · Quantstamp · 4 Aug 2021Fixed
Function `initialize` is used as a `constructor`-like function and used to set important state variables for a contract. However, it seems to be `public` and not protected. Typically you expect some sort of modifier that checks whether the contract has already been initialized. It could be used as an implementation with a proxy that protects `initialize`, but this is not clear with the current scope of the audit. If that assumption is wrong then this is a severe exploit waiting to happen.
Open the reportLowPrivileged Roles and OwnershipArbitrum Token Bridge · Quantstamp · 4 Aug 2021Fixed
There are some actions that could have important consequences for end-users. 0. The owner of the `packages\arb-bridge-peripherals\contracts\tokenbridge\ethereum\gateway\L1GatewayRouter.sol` can call functions `setDefaultGateway` and `setGateways` at any point in time, to alter the existing token contract and gateway addresses mapping record.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="arbitrum"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us