As of 14 Oct 2026, Block has 1 audit report on Trustblock, by Quantstamp, dated 26 Apr 2023. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Block | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 1 | 5 |
| Low | 4 | 6 | 11 |
When creating a listing, a malicious seller can reduce the royalties they have to pay. This is because the allocated royalties per token depends on the number of tokens in a listing.
Open the reportIf a swap is being performed for a `USD_CURRENCY` listing, there is an additional check that happens via `Utils._isClose()`, that compares the converted USD value of `msg.value` against the listing price and determines whether the two prices are similar within a certain threshold. Currently the `isClose()` function has a hardcoded value of 5 for its threshold, allowing for up to 5% of slippage between prices. It is unclear whether this is intentional and aligns with the Block Bar team’s business logic.
Open the reportIn the comments of the `Marketplace.validate()` it is stated "If the tokens have been sold external to this contract, the listing is no longer valid". However, it may still be possible to sell outside of the market without failing this validation.
Open the reportRoyalty shares can be modified by a privileged user even after listing the token in the marketplace. This mean that some users can obtain less fees than expected, and the owner of the token could obtain less funds if the royalty shares are increased between the listing time and the selling time.
Open the reportIn general, it is recommended to give any contract the smallest necessary approval for any digital assets one owns. In this instance, a valid listing requires a seller to approve their entire collection to the marketplace.
Open the report`RoyaltiesOracle._setRoyalty()` doesn't validate whether the `tokenId` provided exists or not, allowing for caller with the `MANAGER_ROLE` to assign royalties to potentially non-existent tokens.
Open the reportThere is currently no limit on how many collectors can be assigned royalites per token via `setRoyaltyByToken()` and `setRoyalty()`, as long as their cummalitive shares does not exceed the `FEE_DENOMINATOR`. It is unclear whether this type of design aligns with the clients business logic.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="block"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us