Bloq security record
As of 14 Oct 2026, Bloq has 1 audit report on Trustblock, by Resonance Security, dated 5 Oct 2023. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Bloq | Security firm: Resonance Security | Date: | Scope: Files named in the report | No open critical findings | Open · IPFS |
Findings9
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 2 | 0 | 2 |
| Low | 3 | 0 | 2 |
MediumInsufficient Validation Of collateralFactorBloq · Resonance Security · 5 Oct 2023Fixed
The functions initialize() and updateCollateralFactor() do not account for the possibility of a collateral factor being introduced as either 0 or 1e18, corresponding to 0% or 100%. This effectively means that in some cases throughout the code, divisions will be made using this value that will yield "Division By Zero" errors, therefore reverting the transaction. Ultimately, this may cause a Denial of Service to legitimate users of the smart contract.
Open the reportMediumMissing Modifier whenNotShutdown On Cross-Chain CallsBloq · Resonance Security · 5 Oct 2023Fixed
The modifier whenNotShutdown is implemented to provide a way for the system's governor to stop all operations during emergencies. However, not all critical functions are protected with this modifier. The functions layer2Leverage(), layer2FlashRepay(), retryLayer2LeverageCallback(), and retryLayer2FlashRepayCallback() do not rely on the protection of the whenNotShutdown modifier and may be used my malicious actors on specific scenarios to damage the entire system.
Open the reportLowMissing Zero Amount Validation Of amountIn_Bloq · Resonance Security · 5 Oct 2023Fixed
The function layer2Leverage() does not perform validation on the input variable amountIn_, therefore making it possible for a user to input a zero amount to be transferred. Some tokens do not perform this check intrinsically and may waste gas and blockchain resources if not accounted for by developers.
Open the reportLowUnnecessary Modifier onlyIfSyntheticTokenIsActive On flashIssue()Bloq · Resonance Security · 5 Oct 2023Fixed
According to the code workflow implemented on the protocol, the modifier onlyIfSyntheticTokenIsActive being used on the function flashIssue() is not necessary since similar validations are already being made on the same smart contract interaction. This optimizes the code to save on gas during execution.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="bloq"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us