As of 14 Oct 2026, Block has 1 audit report on Trustblock, by Quantstamp, dated 26 Apr 2023. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Block | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 1 | 5 |
| Low | 4 | 6 | 11 |
`DEFAULT_ADMIN_ROLE`, `MANAGER_ROLE`, and `PAUSER_ROLE` are initialized to the same address. These roles should be separated because they have different levels of privileges and responsibilities. The `DEFAULT_ADMIN_ROLE` is a highly privileged role that is less frequently used, and as such, it should be stored on a cold wallet for added security. On the other hand, the `MANAGER_ROLE` and `PAUSER_ROLE` are more frequently used and have greater exposure to potential security breaches.
Open the reportBoth the `Listings.listingCount()` and `Marketplace.getSales()` functions should return the number of listings as tracked by the `current()` function, instead, `current()` is called and subtracted by one.
Open the reportWe have identified some code snippets which unnecessarily exhaust gas: - `Listings.sol`: - `L#130`: The whole listing struct is retrieved from storage although only the `owner` member is needed. - `L#242`: The whole listing struct is retrieved from storage although only the `isListed` member is needed. - `_updateListingExpiration` returns the listing in `memory`. This requires the corresponding struct to be retrieved from storage and written to memory before returning. - `Marketplace.sol`: - `L#141 - 143`: this `for` loop iterates over all `listing.tokenIds`. However, there is a `for` loop performing the same iteration in `L#105`.
Open the reportWhen calling `swap()`, funds are transferred using `_sendFunds`. While `swap()` cannot be re-entered due to the `nonReentrant` modifier, other functions modifying the listing being swapped can be entered. An attacker could include a token in the listing for which one of their smart contracts are a royalty collector. This gives them the possibility to re-enter through `deleteListing()` or even `drain()` or `setRoyalty()` in case they hold the corresponding admin role. There may be more re-entrancy attack vectors.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="block"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us