Cyber security record
As of 14 Oct 2026, Cyber has 7 audit reports by 2 security firms on Trustblock; the latest is by HashEx, dated 20 Aug 2024. Those reports list no open critical findings. It also holds 1 deployed contract on 1 chain.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits7
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Cyber | Security firm: HashEx | Date: | Scope: 1 address on Ethereum | No open critical findings | Open · hashex.org |
| Cyberconnect - staking pool | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| CyberConnect - cybergraph | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| CyberConnect - Audit | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Cyberconnect - cybervesting | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| CyberConnect - CyberToken | Security firm: CertiK | Date: | Scope: Not recorded. See the report | No open critical findings | Open · skynet.certik.com |
| CyberConnect | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings45
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 5 | 4 | 0 |
| Medium | 1 | 0 | 6 |
| Low | 23 | 0 | 6 |
HighCentralization Related Risks in CyberGraphCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
In the contract `Soul`, the role `owner` has authority over the functions listed below. - `setMinter`: set/update minter status for an address. - `setTokenURI`: update token uri. - `transferOwnership`: set a new owner for the contract. - `renounceOwnership`: set address(0) as the new owner. Any compromise to the `owner` account may allow a hacker to take advantage of this authority, update minter status and modify uri. the role `minter` has authority over the functions listed below. - `createSoul`: mint soul token. - `setOrg`: update org status for address. - `clearGatedMetadatas`: clear gated metadata on a token. - `batchSetGatedMetadatas`: batch set gated metadata. Any compromise to the `minter` account may allow a hacker to take advantage of this authority issue and modify soul token. --- In the contract `CyberEngine`, the role soul token owner has authority over the functions listed below. - `setOperatorApproval`: set operator for the self(soul token owner). the role soul token owner and corresponding operator have authority over the functions listed below. - `registerEssence`: register essence and create essence contract for soul token owner. - `registerSubscription`: register subscribe and create subscribe contract for soul token owner (can only be called once). - `publishContent`: publish content token set for soul token owner with content parameters. - `share`: publish content token set for soul token owner with share parameters. - `comment`: publish content token set for soul token owner with comment parameters. - `setEssenceData`: update essence middleware and configuration. - `setSubscriptionData`: update subscription configuration. - `setContentData`: update content configuration and middleware. - `setW3stData`: update W3st configuration and middleware. When the soul token owner is labeld as org account in the `soul` contract, the soul token owner and corresponding operator have authority over the functions listed below. - `issueW3st`: issue W3st token set for collect. Any compromise to the `soul` owner account corresponding operator may allow a hacker to take advantage of this authority issue and manipulate user's functionality in `CyberEngine`, like creating unexpected content. --- In the contract `Essence`, the role `Engine` has authority over the functions listed below. Based on design the Engine address should be the contract `CyberEngine`: - `mint`: mint Essence token. In the contract `Subscribe`, the role `Engine` has authority over the functions listed below. Based on design the Engine address should be the contract `CyberEngine`: - `mint`: mint Subscribe token - `extend`: extend the expiration date for one token. In the contract `Content`, the role `Engine` has authority over the functions listed below. Based on design the Engine address should be the contract `CyberEngine`: - `mint`: mint Content token. In the contract `W3st`, the role `Engine` has authority over the functions listed below. Based on design the Engine address should be the contract `CyberEngine`: - `mint`: mint W3st token. --- In the contract `MiddlewareManager`, the role `owner` has authority over the functions listed below. - `allowMw`: update the status for the middleware address. - `transferOwnership`: set a new owner for the contract. - `renounceOwnership`: set address(0) as the new owner. Any compromise to the owner's account may allow a hacker to take advantage of this authority issue and manipulate issue invalid middleware for malicious purposes. --- In the contract `TokenReceiver` the role `owner` has authority over the functions listed below. - `withdraw`: send native token from contract to arbitrary address - `transferOwnership`: set new owner for the contract. - `renounceOwnership`: set address(0) as the new owner. Any compromise to the owner's account may allow a hacker to take advantage of this authority issue and withdraw the native token. In the contract `PermissionMw`, the role `engine` has authority over the functions listed below. Based on design the Engine address should be the contract `CyberEngine`: - `setMwData`: set `_signerStorage` information - `preProcess`: validate collector signature In the contract `LimitedTimePaidMw`, the role `engine` has authority over the functions listed below. Based on design the Engine address should be the contract `CyberEngine`: - `setMwData`: set up limited time paid parameters - `preProcess`: validate collector signature In the contract `Treasury` the role `owner` has authority over the functions listed below. - `setTreasuryAddress`: set new treasury address - `setTreasuryFee`: set new treasury fee - `allowCurrency`: update the currency status - `transferOwnership`: set new owner for the contract. - `renounceOwnership`: set address(0) as the new owner. Any compromise to the owner's account may allow hackers to take advantage of this authority issue and update treasure settings. --- In the contract `CyberAccountFactory` th
Open the reportHighCentralization Related Risks in CyberIdCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
In the contract `CyberId`, the role `owner` has authority over the functions listed below. - `setBaseTokenUri`: set token uri - `setMiddleware`: set middleware - `transferOwnership`: set new owner for the contract. - `renounceOwnership`: set address(0) as the new owner. - `clearGatedMetadatas`: clear gated metadata on a token. - `batchSetGatedMetadatas`: batch set gated metadata(when id not is issued or when id is not expired). Any compromise to the `owner` account may allow a hacker to take advantage of this authority and manipulate the contract setting. --- Note: Update in Commit [26aa0e00eeb15bec52c77abc011be949d2f13e09](https://github.com/cyberconnecthq/cyberid/commit/26aa0e00eeb15bec52c77abc011be949d2f13e09) The contract `MocaId` was renamed to `RealmId`. In the contract `RealmId`(`MocaId`), multiple roles have authority over the functions list below. - `DEFAULT_ADMIN_ROLE`: - `setbaseTokenURI`: set base token uri - `setMiddleware`: set middleware address - `pause`: pause the contract - `unpause`: unpause the contract - `grantRole`: assign `PAUSER_ROLE`, `UPGRADER_ROLE`, `MINTER_ROLE` and `DEFAULT_ADMIN_ROLE` to new address. - `revokeRole`: revoke `PAUSER_ROLE`, `UPGRADER_ROLE`, `MINTER_ROLE` and `DEFAULT_ADMIN_ROLE` from address. - `OPERATOR_ROLE`: - `allowNode`: set allowed node/extension - `setMocaXP`: sets the moca xp - `clearGatedMetadatas`: clear gated metadata on a token - `batchSetGatedMetadatas`: batch set gated metadata(when id not is issued or when id is not expired). Any compromise to the aforementioned roles may allow a hacker to take advantage of this authority and manipulate the MocaId's setting. Update in Commit [26ba7731e79531edf4b1414c730b292672c4b6a9](https://github.com/cyberconnecthq/cyberid/commit/26ba7731e79531edf4b1414c730b292672c4b6a9) The contract using the `owner` role to control the aforementioned functions: - `setbaseTokenURI`: set base token uri - `setMiddleware`: set middleware address - `pause`: pause the contract - `unpause`: unpause the contract - `allowNode`: set allowed node/extension - `clearGatedMetadatas`: clear gated metadata on a token - `batchSetGatedMetadatas`: batch set gated metadata - `transferOwnership`: set new owner for the contract. - `renounceOwnership`: set address(0) as the new owner. --- In the contract `StableFeeMiddleware`, the role `NAME_REGISTRY` has authority over the functions listed below. The name `NAME_REGISTRY` suppose to be one of the name registry contracts. - `setMwData`: update the information for `StableFeeMiddleware`. --- In the contract `TrustOnlyMiddleware`: the role `owner` has authority over the functions listed below. - `preRegister`: pre-check for CyberId registration. - `preRenew`: pre-check for CyberId renew. - `preBid`: pre-check for CyberId bid. - `transferOwnership`: set new owner for the contract. - `renounceOwnership`: set address(0) as the new owner. Any compromise to the `owner` account may allow a hacker to take advantage of this authority, manipulate the contract setting and bypass the validation for id minting. the role `NAME_REGISTRY` has authority over the functions listed below. The name `NAME_REGISTRY` suppose to be one of the name registry contracts. - `setMwData`: update the owner for `TrustOnlyMiddleware`. --- In the contract `PermissionMw`, the role `NAME_REGISTRY` has authority over the functions listed below. The name `NAME_REGISTRY` suppose to be one of the name registry contracts. - `setMwData`: set `_signerStorage` information - `preProcess`: validate preprocess signature
Open the reportHighCentralized Control of Contract UpgradeCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
In the contract `RealmId`(`MocaId`), the role `DEFAULT_ADMIN_ROLE` has the authority to update the implementation contract behind the `MocaId` contract. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow a hacker to take advantage of this authority and change the implementation contract which is pointed by proxy and therefore execute potential malicious functionality in the implementation contract. Note: Update in Commit [26ba7731e79531edf4b1414c730b292672c4b6a9](https://github.com/cyberconnecthq/cyberid/commit/26ba7731e79531edf4b1414c730b292672c4b6a9) The contract uses the `owner` role to control the pause functionality. --- In the contract `CyberEngine`, the role `admin` has the authority to update the implementation contract behind the `CyberEngine` contract. Any compromise to the `admin` account may allow a hacker to take advantage of this authority and change the implementation contract which is pointed by proxy and therefore execute potential malicious functionality in the implementation contract.
Open the reportHighMinting Centralization RiskCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
If `TrustOnlyMiddleware` is used as a middleware in the contract `CyberId`, the role `_owner` has the authority to register/renew/bid CyberIds for free. Any compromise to the `_owner` account may allow a hacker to take advantage of this authority and register/renew/bid any amount of CyberIds at will. ```solidity=185 contract TrustOnlyMiddleware is Ownable, LowerCaseCyberIdMiddleware { //... function preRegister( DataTypes.RegisterCyberIdParams calldata params, bytes calldata ) external payable override returns (uint256) { require(params.msgSender == owner(), "NOT_TRUSTED_CALLER"); return 0; } /// @inheritdoc ICyberIdMiddleware function preRenew( DataTypes.RenewCyberIdParams calldata params, bytes calldata ) external payable override returns (uint256) { require(params.msgSender == owner(), "NOT_TRUSTED_CALLER"); return 0; } /// @inheritdoc ICyberIdMiddleware function preBid( DataTypes.BidCyberIdParams calldata params, bytes calldata ) external payable override returns (uint256) { require(params.msgSender == owner(), "NOT_TRUSTED_CALLER"); return 0; } } ```
Open the reportHighPausing Centralization RisksCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
In the contract `RealmId`(`Mocald.sol`), the role `admin` has the authority to update the status of the `_paused` and further pause/resume the functionality of the `transferFrom()`, `safeTransferFrom()` and `safeTransferFrom()` functions, which effectively impact token transfers. Note: Update in Commit [26ba7731e79531edf4b1414c730b292672c4b6a9](https://github.com/cyberconnecthq/cyberid/commit/26ba7731e79531edf4b1414c730b292672c4b6a9) The contract uses the `owner` role to control the pause functionality. Similarily, the owner of `CyberEngine` also can pause the Content, Essence, and W3st related functionalities in Cybergraph. Any compromise to the private key of the `owner` may allow hackers to take advantage of this authority and allow/prevent external user access to token transfer functionalities.
Open the reportMediumLack of validations in the `recoverERC20()` functCyberconnect - cybervesting · CertiK · 15 Aug 2023Not fixed
The owner can call `recoverERC20()` to transfer any ERC20 tokens from the `CyberVesting` contract. If the owner withdraws a portion of the Cyber tokens before the release end time, `_start + _duration * _numVestings`, there will not be enough tokens to release.
Open the reportLowLack of Asset Whitelist Validation in `withdraw()Cyberconnect - staking pool · CertiK · 9 Apr 2024Not fixed
The `withdraw()` allows users to withdraw assets from the contract. However, it does not validate whether the assets being withdrawn are part of the `assetWhitelist`. This oversight could lead to the transfer of unapproved assets or potentially expose the contract to reentrancy attacks if the `safeTransfer` function interacts with a malicious contract.
Open the reportLowLack of Asset Whitelisting per BridgeCyberconnect - staking pool · CertiK · 9 Apr 2024Not fixed
The contract uses a generic `assetWhitelist` mapping to control which assets are allowed for bridging. However, this design does not account for the possibility that different bridges may have different requirements or risk profiles for asset whitelisting. The current implementation of the `setAssetWhitelist()` and the `_bridge` function does not provide a way to specify which assets are whitelisted for which bridges.
Open the reportLowMissing `whenNotPaused` Modifier in Critical FuncCyberconnect - staking pool · CertiK · 9 Apr 2024Not fixed
The `withdraw`, `bridge`, and `bridgeWithSig` functions lack the `whenNotPaused` modifier, which means these functions can still be called when the contract is paused. This could lead to potential risks, especially in emergency situations where pausing the contract is necessary to prevent further transactions.
Open the reportLowPotential Out-of-Gas ExceptionCyberconnect - staking pool · CertiK · 9 Apr 2024Not fixed
When a loop allows an arbitrary number of iterations or accesses state variables in its body, the function may run out of gas and revert the transaction. ```solidity=106 for (uint256 i = 0; i < assets.length; i++) { ``` Function `CyberStakingPool.withdraw` contains a loop and its loop condition depends on parameters: `assets`.
Open the reportShow 10 more
LowReuse of Deposit Event for Different Deposit TypeCyberconnect - staking pool · CertiK · 9 Apr 2024Not fixed
The `Deposit` event is emitted both in the `deposit` function for ERC20 token deposits and in the `depositETH` function for native ETH deposits. This reuse of the event for different deposit types could lead to confusion and complications in off-chain monitoring systems that rely on event logs to distinguish between the two types of deposits. An off-chain monitoring system is set up to track deposits into the contract. It might incorrectly interpret a `Deposit` event from a `depositETH` call as a regular ERC20 token deposit, leading to inaccurate tracking of the contract's activity.
Open the reportLowIncompatibility With Deflationary Tokens (Non-staCyberConnect - cybergraph · CertiK · 4 Mar 2024Not fixed
The project design may not be compatible with non-standard ERC20 tokens, such as deflationary tokens or rebase tokens.
Open the reportLowCheck-effect-interaction Pattern ViolationCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
In both project `cyberId` and `cyberGraph`, the function `_chargeAndRefundOverPayment` or equivalent logic is being used to return the funds for the overpayment. Most of the return funds processes are triggered in the middle of the transaction but the actual data value has not been updated yet, for example, in middleware pre-process, which will trigger the external call for the funds transfer, which will violate the check-effect-interaction pattern.
Open the reportLowInsufficient Validation on `startTimestamp` and `CyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
When adding/updating limited time paid information, the function `setMwData` will validate the relationship between the start and end timestamp: ```solidity=119 require(endTimestamp > startTimestamp, "INVALID_TIME_RANGE"); ``` However, there is no validation between the current and start/end timestamps. As a result, the input information can be invalid.
Open the reportLowLack of Input ValidationCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
The cited functions do not check if the inputs are valid. - The length of `uri` in `setEssenceData()`, `setContentData()`, `setW3stData()`, `setBaseTokenUri()`, `setbaseTokenURI()`, and `setTokenURI()` should be greater than zero. Moreover, the function `setSubscriptionData()` does not check if the inputs are valid values. - the length of `tokenURI` should be greater than zero - `recipient` should be a nonzero address - `pricePerSub` and `dayPerSub` should be greater than zero
Open the reportLowLack of Storage Gap in Upgradeable ContractCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
There is no storage gap preserved in the logic contract. Any logic contract that acts as a base contract that needs to be inherited by other upgradeable child should have a reasonable size of storage gap preserved for the new state variable introduced by the future upgrades.
Open the reportLowMissing Check for Current ValuesCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
The following functions do not check if the input is equal to the current value, an equivalent value can return directly without updating the state to save gas. - `function allowMw(address mw, bool allowed)` - `function setTreasuryAddress(address treasuryAddress)` - `function setTreasuryFee(uint16 treasuryFee)` - `function allowCurrency(address currency, bool allowed)`
Open the reportLowMissing Emit EventsCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
Functions that update state variables should emit relevant events as notifications.
Open the reportLowMissing Validation on `proxy` address and predictCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
The function `createAccount` will compute the deploy address first and try to create the contract with the same salt. However, there is no validation between computed address and deployed address to ensure the deployment is successful.
Open the reportLowMissing Zero Address ValidationCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
Addresses are not validated before assignment or external calls, potentially allowing the use of zero addresses and leading to unexpected behavior or vulnerabilities. For example, transferring tokens to a zero address can result in a permanent loss of those tokens. ```solidity=44 payable(to).transfer(amount); ``` - `to` is not zero-checked before being used.
Open the reportShow 9 more
LowMissing Zero Address ValidationCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
The cited addresses are missing a check that they are not `address(0)`. - `_owner` - `_oracleAddress` - `_recipient` - `_entryPoint` and `_soul` in `CyberAccountFactory`
Open the reportLowPotential Failure on `safeBatchTransferFrom`CyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
The contract `content` and `W3st` provide `safeBatchTransferFrom`, which will try to query the transferability for each token then do the batch transfer. ```solidity=84 function safeBatchTransferFrom( address from, address to, uint256[] calldata ids, uint256[] calldata amounts, bytes calldata data ) public virtual override { for (uint256 i = 0; i < ids.length; i++) { if ( !ICyberEngine(ENGINE).getW3stTransferability(_account, ids[i]) ) { revert("TRANSFER_NOT_ALLOWED"); } } super.safeBatchTransferFrom(from, to, ids, amounts, data); } ``` However, if one of the token in the list is not transferrable, the whole transaction will be reverted. As a result the user may need to create a transaction with updated input.
Open the reportLowRedundant Calls to `_disableInitializers()`CyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
The function `_disableInitializers()` is already called in the parent contracts, which can ensure that the derived contract is initialized. There is no need to call it again in the derived contracts, this could save gas and make the code more efficient.
Open the reportLowUnused ContractCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
The project contains `Owned` contract definitions that is not used, which can lead to unnecessary complexity and reduced maintainability. ```solidity abstract contract Owned is Initializable { //... } ```
Open the reportLowUsage of `transfer`/`send` for Sending Native TokCyberConnect - Audit · CertiK · 5 Sep 2023Not fixed
It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring native tokens, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=44 payable(to).transfer(amount); ```
Open the reportLowLack of input validation for `start_`Cyberconnect - cybervesting · CertiK · 15 Aug 2023Not fixed
The input `start_` of constructor is missing a check to ensure it is greater than `block.timestamp`.
Open the reportLowLack of sanity check to ensure the Cyber token isCyberconnect - cybervesting · CertiK · 15 Aug 2023Not fixed
The `CyberVesting` contract lacks a sanity check to ensure the Cyber token balance is sufficient to be released.
Open the reportLowMissing Emit EventsCyberconnect - cybervesting · CertiK · 15 Aug 2023Not fixed
There should always be events emitted in the sensitive functions that are controlled by centralization roles.
Open the reportLowDraft Openzeppelin DependenciesCyberConnect - CyberToken · CertiK · 3 Aug 2023Not fixed
The contract `CyberToken` utilized draft-IERC20Permit.sol which is a draft Openzeppelin contract. OpenZeppelin contracts may be considered draft contracts if they have not received adequate security auditing or are liable to change with future development. Since 4.9.0 the contract `ERC20Permit` is no longer a draft. More detail can be found in the [change log](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/CHANGELOG.md#490-2023-05-23).
Open the reportContracts1
| Address | Chain | Source code |
|---|---|---|
| 0x14778860e937f509e651192a90589de711fb88a9 | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="cyber"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us