Base security record
As of 31 Oct 2026, Base has 2 audit reports by 1 security firm on Trustblock; the latest is by Cantina, dated 2 Oct 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Coinbase: B20 v3 | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Coinbase: 200ms blocks | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
Findings3
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 0 | 3 |
Marked Informational by the firms. Not counted as findings.
InformationalAn additional BaseTime update can diverge from the claimed block timeCoinbase: 200ms blocks · Cantina · 1 Oct 2026Acknowledged
The report gives no description here.
Open the reportInformationalBaseTime metadata can be accepted before Denim activationCoinbase: 200ms blocks · Cantina · 1 Oct 2026Acknowledged
The report gives no description here.
Open the reportInformationalBaseTime predeploy activation does not pin the proxy runtime to its canonical code hashCoinbase: 200ms blocks · Cantina · 1 Oct 2026Acknowledged
The report gives no description here.
Open the reportInformationalInconsistent integer overflow handling across the three millisecond timestamp computationsCoinbase: 200ms blocks · Cantina · 1 Oct 2026Acknowledged
The report gives no description here.
Open the reportInformationalOnchain intermediate interval is not pinned to the ZK prover sampling cadenceCoinbase: 200ms blocks · Cantina · 1 Oct 2026Acknowledged
The report gives no description here.
Open the reportInformationalSequencer and verifier disagree on a zero activation timestampCoinbase: 200ms blocks · Cantina · 1 Oct 2026Acknowledged
The report gives no description here.
Open the reportInformationalSpeedup activation trusts schedule index 13 without binding it to DenimCoinbase: 200ms blocks · Cantina · 1 Oct 2026Acknowledged
The report gives no description here.
Open the reportInformationalThe first transaction can read the previous Denim timeCoinbase: 200ms blocks · Cantina · 1 Oct 2026Acknowledged
The report gives no description here.
Open the reportInformationalB20 precompiles are missing from the Base documentation describing precompilesCoinbase: B20 v3 · Cantina · 2 Oct 2026Fixed
The report gives no description here.
Open the reportInformationalSuggestions to improve the test coverage for the current-token recipient checksCoinbase: B20 v3 · Cantina · 2 Oct 2026Fixed
The report gives no description here.
Open the reportShow 6 more
InformationalSuggestions to improve the test coverage for the Transfer-executor policyCoinbase: B20 v3 · Cantina · 2 Oct 2026Fixed
The report gives no description here.
Open the reportInformationalUnknown policy IDs have inconsistent documented and actual behaviorCoinbase: B20 v3 · Cantina · 2 Oct 2026Fixed
The report gives no description here.
Open the reportInformationalOff by one in the per height block retention capCoinbase: 200ms blocks · Cantina · 1 Oct 2026Fixed
The report gives no description here.
Open the reportInformationalPending transaction millisecond metadata depended on request orderCoinbase: 200ms blocks · Cantina · 1 Oct 2026Fixed
The report gives no description here.
Open the reportInformationalQueued reorgs can overwrite an earlier proof history unwindCoinbase: 200ms blocks · Cantina · 1 Oct 2026Fixed
The report gives no description here.
Open the reportInformationalStaged sync does not enforce the Denim timestamp scheduleCoinbase: 200ms blocks · Cantina · 1 Oct 2026Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="base-bridge"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us