BOB Onramp security record
As of 10 Nov 2026, BOB Onramp has 4 audit reports by 1 security firm on Trustblock; the latest is by Pashov Audit Group, dated 21 Oct 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits7
Newest first
| Report | Security firm | Date | Scope | Critical findings | Source |
|---|---|---|---|---|---|
| BOB Staking security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded; see the report | 2 critical findings, fixed | GitHub ↗ |
| BOB security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| BOB security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| BOB security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| BOB security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| BOB Onramp security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| BOB USDCBridge security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
Findings56
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 2 |
| Medium | 0 | 4 | 6 |
| Low | 0 | 20 | 22 |
CriticalinstantWithdraw() does not transfer _amountForContract , locking tokensBOB Staking security review · Pashov Audit Group · 21 Oct 2025Fixed
The report gives no description here.
Open the reportCriticalStakes not forwarded post-delegation, positions unwithdrawableBOB Staking security review · Pashov Audit Group · 21 Oct 2025Fixed
The report gives no description here.
Open the reportHighBonuses obtainable without proper locking due to flawed lock periodBOB Staking security review · Pashov Audit Group · 21 Oct 2025Fixed
The report gives no description here.
Open the reportHighDelegating to address(0) empties contract via alterGovernanceDelegatee()BOB Staking security review · Pashov Audit Group · 21 Oct 2025Fixed
The report gives no description here.
Open the reportMediumCondition setter functions are brokenBOB Staking security review · Pashov Audit Group · 21 Oct 2025Fixed
The report gives no description here.
Open the reportMediumDoS of staking due to unguarded receiver lock periodBOB Staking security review · Pashov Audit Group · 21 Oct 2025Fixed
The report gives no description here.
Open the reportMediumTokens sent to old cached receiver address in OfframpRegistryBOB security review · Pashov Audit Group · 20 Mar 2025Fixed
The report gives no description here.
Open the reportMediumGas Price can change, making sigFees calculation insufficientBOB security review · Pashov Audit Group · 26 Jun 2024Fixed
The report gives no description here.
Open the reportMediumBTC transactions can have multiple inputs and outputsBOB Onramp security review · Pashov Audit Group · 22 Apr 2024Fixed
The report gives no description here.
Open the reportMediumgetTxOutputValue() doesn't sum up all the valuesBOB Onramp security review · Pashov Audit Group · 22 Apr 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowAnyone can trigger others' claims causing front- running reward lossBOB Staking security review · Pashov Audit Group · 21 Oct 2025Fixed
The report gives no description here.
Open the reportLowMissing validation allows bonusEndTime to be set to past timestampsBOB Staking security review · Pashov Audit Group · 21 Oct 2025Fixed
The report gives no description here.
Open the reportLowResidual recycling lets attackers farm wrapper bonus without new capitalBOB Staking security review · Pashov Audit Group · 21 Oct 2025Fixed
The report gives no description here.
Open the reportLowTIME_UNIT is not exactly one yearBOB Staking security review · Pashov Audit Group · 21 Oct 2025Fixed
The report gives no description here.
Open the reportLowUnguarded claimRewards() can be leveraged to deny Instant withdrawal feesBOB Staking security review · Pashov Audit Group · 21 Oct 2025Fixed
The report gives no description here.
Open the reportLowUsers cannot opt out of hybrid node delegationBOB Staking security review · Pashov Audit Group · 21 Oct 2025Fixed
The report gives no description here.
Open the reportLowcreateOrder() could have the deadline parameterBOB security review · Pashov Audit Group · 20 Mar 2025Fixed
The report gives no description here.
Open the reportLowImplementing renounceOwnership() is dangerousBOB security review · Pashov Audit Group · 20 Mar 2025Fixed
The report gives no description here.
Open the reportLowLP cannot prevent emergency offramp fund withdrawalsBOB security review · Pashov Audit Group · 20 Mar 2025Fixed
The report gives no description here.
Open the reportLowOfframp providers can receive ERC20 tokens without sending BTCBOB security review · Pashov Audit Group · 20 Mar 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowtxProofDifficultyFactor should have upper limitBOB security review · Pashov Audit Group · 20 Mar 2025Fixed
The report gives no description here.
Open the reportLowGas bomb via provided extra dataBOB security review · Pashov Audit Group · 25 Oct 2024Fixed
The report gives no description here.
Open the reportLowMissing slippage for strategiesBOB security review · Pashov Audit Group · 25 Oct 2024Fixed
The report gives no description here.
Open the reportLowPellStrategy#stakerStrategyShares function should be viewBOB security review · Pashov Audit Group · 25 Oct 2024Fixed
The report gives no description here.
Open the reportLowThe gateway owner can set a malicious swapper that could cause lossesBOB security review · Pashov Audit Group · 12 Aug 2024Fixed
The report gives no description here.
Open the reportLowUnnecessary onlyOwner restrictionBOB security review · Pashov Audit Group · 12 Aug 2024Fixed
The report gives no description here.
Open the reportLowVelodrome pool pauses can potentially lead to disrupting BTC bridgingBOB security review · Pashov Audit Group · 12 Aug 2024Fixed
The report gives no description here.
Open the reportLowHardcoded BTC_SIG_GAS_USAGE can brick the bridge in case of a network upgradeBOB security review · Pashov Audit Group · 26 Jun 2024Fixed
The report gives no description here.
Open the reportLowmultisigHash should have an expiration deadlineBOB security review · Pashov Audit Group · 26 Jun 2024Fixed
The report gives no description here.
Open the reportLowSetting max amount of msg.value for redeem/mint feesBOB security review · Pashov Audit Group · 26 Jun 2024Fixed
The report gives no description here.
Open the reportShow 2 more
LowBridged USDC Standard not fully compliedBOB USDCBridge security review · Pashov Audit Group · 22 Apr 2024Fixed
The report gives no description here.
Open the reportLowTokens with decimals <8 not supportedBOB Onramp security review · Pashov Audit Group · 22 Apr 2024Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="bob-onramp"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us