Beam security record
As of 30 Oct 2026, Beam has 3 audit reports by 2 security firms on Trustblock; the latest is by QuillAudits, dated 6 Jan 2025. Those reports list no open critical findings. It also holds 1 deployed contract on 1 chain.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Beam V2 | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| Beam V1 | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| Beam | Security firm: HashEx | Date: | Scope: 1 address on Ethereum | No open critical findings | Open · hashex.org |
Findings5
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 0 | 3 |
MediumImplement a function to sweep dust accumulationBeam V2 · QuillAudits · 6 Jan 2025Fixed
There is an edge case where rounding issue can create dust amount which will accumulate overtimewhenever swap happens. However there is no way to pull those funds out.
Open the reportMediumRouter is not able to handle Fee on Transfer TokensBeam V2 · QuillAudits · 6 Jan 2025Fixed
The current implementation of _executeSwap might not be able to handle Fee on Transfer Tokens.This is because the router will receive less amount than expected and will then proceed to execute as if the input amount is same.
Open the reportLowConsider sanitizing user inputsBeam V2 · QuillAudits · 6 Jan 2025Fixed
The current code lack input sanitization of the parameters that are passed. This leads to break a wholelot of invariants that a router should hold creating in unintended consequences. Here is a list of core invariants that should be checked. A route must consist at least of two tokens. RouterLogic must never consume more input tokens than the provided. Only the Router can invoke swapExactInput/swapExactInputSingle. Amounts must never be larger than uint128.max. During swapExactInput, all input amounts must be consumed without any leftovers. Token addresses must be unique.
Open the reportLowLack of reentrancy guard may result in unintended statesBeam V2 · QuillAudits · 6 Jan 2025Fixed
Currently swapExactInput , swapExactInputSingle lacks non-reentrant modifer. This means that thereis a scenario under which one can reenter into these function before the previous execution is fnished. While an actual reentrant poc has not be crafted, it has been observed that most of exploits happen due to arbitrary user input. Therefore it is crucial to limit the user fexibility.
Open the reportLowUnused Event, Error and INIT_CODE_HASHBeam V2 · QuillAudits · 6 Jan 2025Fixed
Contract contains unused elements that do not serve any functional purpose, increasing the codebase size unnecessarily:event: CustomApproval, errors: WrongGasContract, NotEnoughToPayGasFee, ChainNotEnabled and INIT_CODE_HASH: is declared but not utilized in any function
Open the reportContracts1
| Address | Chain | Source code |
|---|---|---|
| 0x62d0a8458ed7719fdaf978fe5929c6d342b0bfce | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="beam"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us