As of 16 Oct 2026, BNB Chain has 2 audit reports by 1 security firm on Trustblock; the latest is by CertiK, dated 3 Feb 2023. Those reports list no open critical findings. It also holds 2 deployed contracts on 1 chain.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| BNB Chain - BGBP (refreshed) | Security firm: CertiK | Date: | Scope: 1 address on Ethereum | No open critical findings | Open · skynet.certik.com |
| BNB Chain - BNB (refreshed) | Security firm: CertiK | Date: | Scope: 1 address on Ethereum | No open critical findings | Open · skynet.certik.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 16 | 0 | 0 |
The change of the contract's owner overrides the previously set owner with the new one without guaranteeing the new owner is able to actuate transactions on-chain.
Open the reportThe linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.
Open the reportA local variable is shadowing another component defined elsewhere. ```solidity=769 function allowance(address _owner, address _spender) public view returns (uint256 remaining) { ``` - Local variable `_owner` in `BGBPToken.allowance()` shadows the variable `_owner` in `Ownable`.
Open the reportSolidity frequently releases new compiler versions. Using an old version prevents access to new Solidity security features. We also recommend avoiding complex `pragma` statements. The pragma statement in use allows old versions: ```solidity=1 pragma solidity 0.5.8; ```
Open the reportThere are some typos in the comments.
Open the reportThe linked functions are equivalent to the compiler-generated getter functions for the respective variables.
Open the reportThe linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportUsage of `throw` should be replaced with `revert()`.
Open the reportThe `BNB` contract has some references to `ETH` instead of `BNB` even though it is deployed on the Binance Smart Chain (BSC)
Open the reportFunctions that update state variables should emit relevant events as notifications.
Open the reportThe linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.
Open the reportA user-defined component is shadowing a built-in symbol. ```solidity=31 function assert(bool assertion) internal { ``` - Function `assert` is shadowing a built-in symbol.
Open the reportSolidity frequently releases new compiler versions. Using an old version prevents access to new Solidity security features. We also recommend avoiding complex `pragma` statements. The pragma statement in use allows old versions and it is not locked: ```solidity=1 pragma solidity ^0.4.8; ```
Open the report```solidity=89 returns (bool success) { ``` - The function `approve` implicitly returns and never writes the return variable `success`. --- ```solidity=97 function transferFrom(address _from, address _to, uint256 _value) returns (bool success) { ``` - The function `transferFrom` implicitly returns and never writes the return variable `success`. --- ```solidity=110 function burn(uint256 _value) returns (bool success) { ``` - The function `burn` implicitly returns and never writes the return variable `success`. --- ```solidity=119 function freeze(uint256 _value) returns (bool success) { ``` - The function `freeze` implicitly returns and never writes the return variable `success`. --- ```solidity=128 function unfreeze(uint256 _value) returns (bool success) { ``` - The function `unfreeze` implicitly returns and never writes the return variable `success`.
Open the reportIt is not recommended to use Solidity's `transfer()` and `send()` functions for transferring ETH, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=140 owner.transfer(amount); ``` - `withdrawEther()` uses `transfer()`.
Open the reportThe linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the report| Address | Chain | Source code |
|---|---|---|
| 0xb8c7…dd520xb8c77482e45f1f44de1745f52c74426c631bdd52 | Chain: Ethereum | Source code: Verified source |
| 0xc9a2…12ec0xc9a2c4868f0f96faaa739b59934dc9cb304112ec | Chain: Ethereum | Source code: Verified source |
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="bnb-chain"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us