Circle security record
As of 14 Oct 2026, Circle has 8 audit reports by 2 security firms on Trustblock; the latest is by ChainSecurity, dated 9 Feb 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits8
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Circle xReserve Smart Contracts | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Circle Gateway Smart Contracts | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| CCTP V2 Smart Contracts (inclusive of the Standard | Security firm: ChainSecurity | Date: | Scope: Not recorded. See the report | No open critical findings | Open · chainsecurity.com |
| CCTP V2 Smart Contracts | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Circle Perimeter | Security firm: ChainSecurity | Date: | Scope: Not recorded. See the report | 1 critical finding, fixed | Open · chainsecurity.com |
| Cross Chain Transfer Protocol (CCTP) | Security firm: ChainSecurity | Date: | Scope: Not recorded. See the report | No open critical findings | Open · chainsecurity.com |
| Aida Circle - Audit 1 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Aida Circle - Pentest | Security firm: CertiK | Date: | Scope: Not recorded. See the report | No open critical findings | Open · skynet.certik.com |
Findings68
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 5 |
| Medium | 1 | 0 | 7 |
| Low | 2 | 5 | 47 |
CriticalcancelFunded Counts Assets TwiceCircle Perimeter · ChainSecurity · 26 Sep 2023Fixed
The report gives no description here.
Open the reportHighPossible to Inject Data on Burn AuthorizationsCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportHighViolation of Non-Custodial PropertyCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportHighfeeVault Stuck FundsCircle Perimeter · ChainSecurity · 26 Sep 2023Fixed
The report gives no description here.
Open the reportHighWithdrawal DoSCircle Perimeter · ChainSecurity · 26 Sep 2023Fixed
The report gives no description here.
Open the reportHighCentralization Related RisksAida Circle - Audit 1 · CertiK · 28 Sep 2022Fixed
In the contract AidaNFT.sol the role `GOV_ROLE` has authority over the following functions: - withdraw() - pause() - unpause() The role `WITHDRAWN_VALUE_ROLE` has authority over the following function: - withdraw() Any compromise to the `GOV_ROLE` and `WITHDRAWN_VALUE_ROLE` accounts may allow a hacker to take advantage of this authority and withdraw ETH from this contract and pause/unpause mint() and withdraw() functions.
Open the reportMediumFees for Fast Burns Can Be AvoidedCCTP V2 Smart Contracts (inclusive of the Standard · ChainSecurity · 8 Apr 2025Fixed
The report gives no description here.
Open the reportMediumFees for Fast Burns Can Be AvoidedCCTP V2 Smart Contracts · ChainSecurity · 24 Mar 2025Fixed
The report gives no description here.
Open the reportMediumFull Cancel Request Not PossibleCircle Perimeter · ChainSecurity · 26 Sep 2023Fixed
The report gives no description here.
Open the reportMediumLate Fees Do Not Go to First Loss VaultCircle Perimeter · ChainSecurity · 26 Sep 2023Fixed
The report gives no description here.
Open the reportShow 10 more
MediumMissing Permission ChecksCircle Perimeter · ChainSecurity · 26 Sep 2023Fixed
The report gives no description here.
Open the reportMediumpaymentDueDate Updated After Last PaymentCircle Perimeter · ChainSecurity · 26 Sep 2023Fixed
The report gives no description here.
Open the reportMediumReentrancy AttackAida Circle - Audit 1 · CertiK · 28 Sep 2022Fixed
A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. ### External call(s) ```solidity=69 _safeMint(msg.sender, id); ``` * This function call executes the following external call(s). * In `ERC721._checkOnERC721Received`, * `IERC721Receiver(to).onERC721Received(_msgSender(),from,tokenId,data)` ### State variables written and Event emitted after the call(s) ```solidity=70 _setTokenURI(id, metadataURI); totalWithdrawals += msg.value; emit tokenMint(id, metadataURI, msg.sender, msg.value); metadataURIExists[metadataURI] = true; ``` An attacker can perform a reentrancy attackto mint multiple NFT using the same "metadataURI".
Open the reportLowDuplicated CodeCircle xReserve Smart Contracts · ChainSecurity · 9 Feb 2026Fixed
The report gives no description here.
Open the reportLowEvent IndexingCircle xReserve Smart Contracts · ChainSecurity · 9 Feb 2026Fixed
The report gives no description here.
Open the reportLowMissing Zero Address CheckCircle xReserve Smart Contracts · ChainSecurity · 9 Feb 2026Fixed
The report gives no description here.
Open the reportLowRedundant CheckCircle xReserve Smart Contracts · ChainSecurity · 9 Feb 2026Fixed
The report gives no description here.
Open the reportLowUnused FunctionCircle xReserve Smart Contracts · ChainSecurity · 9 Feb 2026Fixed
The report gives no description here.
Open the reportLowEIP-1155 Compliant View Functions in Balances Might RevertCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportLowFunction Implementation Does Not Match SpecificationsCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowInconsistent Behavior of View Functions in BalancesCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportLowIndexed Addresses in DenylisterChangedCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportLowMisleading Field Name NonceCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportLowMissing Blacklist CheckCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportLowMissing Sanity ChecksCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportLowNon-standard EIP-7201 Formula IdentifierCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportLowSame Chain Transfers May Be Subject to a FeeCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportLowUnchecked Return Value of Identity PrecompileCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportLowUnused FunctionsCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportLowUnused Import in BalancesCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowValidation of TypedMemView ReferencesCircle Gateway Smart Contracts · ChainSecurity · 8 Jul 2025Fixed
The report gives no description here.
Open the reportLowIncorrect NatspecCCTP V2 Smart Contracts (inclusive of the Standard · ChainSecurity · 8 Apr 2025Fixed
The report gives no description here.
Open the reportLowMissing Events on InitializationCCTP V2 Smart Contracts (inclusive of the Standard · ChainSecurity · 8 Apr 2025Fixed
The report gives no description here.
Open the reportLowOld Version of TypedMemViewCCTP V2 Smart Contracts (inclusive of the Standard · ChainSecurity · 8 Apr 2025Fixed
The report gives no description here.
Open the reportLowPossible Underflows in Relay FunctionCCTP V2 Smart Contracts (inclusive of the Standard · ChainSecurity · 8 Apr 2025Fixed
The report gives no description here.
Open the reportLowRedundant CastingCCTP V2 Smart Contracts (inclusive of the Standard · ChainSecurity · 8 Apr 2025Fixed
The report gives no description here.
Open the reportLowUse Constant Instead of 1 or 0CCTP V2 Smart Contracts (inclusive of the Standard · ChainSecurity · 8 Apr 2025Fixed
The report gives no description here.
Open the reportLowIncorrect NatspecCCTP V2 Smart Contracts · ChainSecurity · 24 Mar 2025Fixed
The report gives no description here.
Open the reportLowMissing Events on InitializationCCTP V2 Smart Contracts · ChainSecurity · 24 Mar 2025Fixed
The report gives no description here.
Open the reportLowOld Version of TypedMemViewCCTP V2 Smart Contracts · ChainSecurity · 24 Mar 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowPossible Underflows in Relay FunctionCCTP V2 Smart Contracts · ChainSecurity · 24 Mar 2025Fixed
The report gives no description here.
Open the reportLowRedundant CastingCCTP V2 Smart Contracts · ChainSecurity · 24 Mar 2025Fixed
The report gives no description here.
Open the reportLowUse Constant Instead of 1 or 0CCTP V2 Smart Contracts · ChainSecurity · 24 Mar 2025Fixed
The report gives no description here.
Open the reportLowCallback State Not UsedCircle Perimeter · ChainSecurity · 26 Sep 2023Fixed
The report gives no description here.
Open the reportLowcompleteFullPayment Return ValueCircle Perimeter · ChainSecurity · 26 Sep 2023Fixed
The report gives no description here.
Open the reportLowInconsistent State After Withdrawal CancellationCircle Perimeter · ChainSecurity · 26 Sep 2023Fixed
The report gives no description here.
Open the reportLowMissing Sanity ChecksCircle Perimeter · ChainSecurity · 26 Sep 2023Fixed
The report gives no description here.
Open the reportLowonlyPoolAdmin ModifierCircle Perimeter · ChainSecurity · 26 Sep 2023Fixed
The report gives no description here.
Open the reportLowPool Tokens Not TransferableCircle Perimeter · ChainSecurity · 26 Sep 2023Fixed
The report gives no description here.
Open the reportLowDefault Optimizer ConfigurationCross Chain Transfer Protocol (CCTP) · ChainSecurity · 26 Apr 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowInconsistent Type Used for NonceCross Chain Transfer Protocol (CCTP) · ChainSecurity · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowMissing Event in OwnableCross Chain Transfer Protocol (CCTP) · ChainSecurity · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowUnchecked Return Value for Functions From TypedMemViewCross Chain Transfer Protocol (CCTP) · ChainSecurity · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowUnrelevant Indexed Event FieldsCross Chain Transfer Protocol (CCTP) · ChainSecurity · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowWrong Values Emitted in EventCross Chain Transfer Protocol (CCTP) · ChainSecurity · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowImproper Usage of `public` and `external` TypeAida Circle - Audit 1 · CertiK · 28 Sep 2022Fixed
`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.
Open the reportLowUsage of `transfer`/`send` for sending EtherAida Circle - Audit 1 · CertiK · 28 Sep 2022Fixed
It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=84 holderAddress.transfer(amount); ``` - `AidaNFT.withdraw` uses `transfer()`.
Open the reportLowClickjackingAida Circle - Pentest · CertiK · 26 Sep 2022Fixed
The HTTP response of the GET request to "https://dev.aida.darweb3.com" and "https://dev.darweb3.com/" doesn't contain any security headers to prevent the website from loading in an iframe.
Open the reportLowNo Rate limitingAida Circle - Pentest · CertiK · 26 Sep 2022Fixed
The confirmation link before making a transaction enables the user to receive an email with a link to confirm the transaction. We found that the email could be sent repeatedly.
Open the reportLowWallet disconnect is vulnerable to CSRFAida Circle - Pentest · CertiK · 26 Sep 2022Fixed
This API is used to disconnect the wallet. When the user clicks the disconnect button on the web page, the application sends a POST request to the server. We found that this `POST` request is vulnerable to CSRF attacks.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="circle"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us