BENQI security record
As of 21 Oct 2026, BENQI has 3 audit reports by 1 security firm on Trustblock; the latest is by Cyfrin, dated 10 Nov 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| BENQI Governance Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Benqi Collateral Migrator Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| BENQI Ignite Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Original removed |
Findings26
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 5 |
| Low | 0 | 10 | 10 |
HighZeeve admin could drain ValidatorRewarder by abusing off-chain BLS validation due to QI rewards being granted to failed registrationsBENQI Ignite Audit Report · Cyfrin · 11 Dec 2024Fixed
The report gives no description here.
Open the reportMediumIgnite fee is not returned for pre-validated QI stakes in the event of registration failureBENQI Ignite Audit Report · Cyfrin · 11 Dec 2024Fixed
The report gives no description here.
Open the reportMediumInconsistent transfers of native tokens could result in unexpected loss of fundsBENQI Ignite Audit Report · Cyfrin · 11 Dec 2024Fixed
The report gives no description here.
Open the reportMediumRedemption of failed registration fees and pre-validated QI is not guaranteed to be possibleBENQI Ignite Audit Report · Cyfrin · 11 Dec 2024Fixed
The report gives no description here.
Open the reportMediumRedemption of slashed registrations could result in DoS due to incorrect state updateBENQI Ignite Audit Report · Cyfrin · 11 Dec 2024Fixed
The report gives no description here.
Open the reportMediumThe default admin role controls all other roles within StakingContractBENQI Ignite Audit Report · Cyfrin · 11 Dec 2024Fixed
The report gives no description here.
Open the reportLowAsymmetric gauge unregistration can result in misallocation of tokensBENQI Governance Audit Report · Cyfrin · 10 Nov 2025Fixed
The report gives no description here.
Open the reportLowDistribution logic can be broken by upgrades to the GaugeRegistrar by the DAO to add logic to modify the enableUpdateVotingPowerHook configurationBENQI Governance Audit Report · Cyfrin · 10 Nov 2025Fixed
The report gives no description here.
Open the reportLowDistributionManagerSetup::canDistribute should return false rather than revertingBENQI Governance Audit Report · Cyfrin · 10 Nov 2025Fixed
The report gives no description here.
Open the reportLowReward distribution can be skipped when executed within the vote window buffer of a new epochBENQI Governance Audit Report · Cyfrin · 10 Nov 2025Fixed
The report gives no description here.
Open the reportShow 6 more
LowCollateralMigrator reverts when pre-existing funds are used for flash loan feesBenqi Collateral Migrator Audit Report · Cyfrin · 6 Apr 2025Fixed
The report gives no description here.
Open the reportLowMigrating collateral will leave dust amounts of source tokens behindBenqi Collateral Migrator Audit Report · Cyfrin · 6 Apr 2025Fixed
The report gives no description here.
Open the reportLowUnbounded loop in CollateralMigrator::_removeMigrationConfig- Data may hinder contract maintainabilityBenqi Collateral Migrator Audit Report · Cyfrin · 6 Apr 2025Fixed
The report gives no description here.
Open the reportLowUser LTV always worsens after migrationBenqi Collateral Migrator Audit Report · Cyfrin · 6 Apr 2025Fixed
The report gives no description here.
Open the reportLowIncorrect operator when validating subsidisation capBENQI Ignite Audit Report · Cyfrin · 11 Dec 2024Fixed
The report gives no description here.
Open the reportLowStakingContract::slippage can be outside of minSlippage or maxSlippageBENQI Ignite Audit Report · Cyfrin · 11 Dec 2024Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="benqi"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us