DappLooker security record
As of 3 Nov 2026, DappLooker has 1 audit report on Trustblock, by QuillAudits, dated 20 Mar 2023. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| dApplooker | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Findings6
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 2 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 2 |
HighFrontrunningdApplooker · QuillAudits · 20 Mar 2023Fixed
Upon deployment, the expected contract owner would have to call initialize( ) else the owner characteristics and privileges do not get set. This is an issue for two reasons:Scenario 1: Initialize is frontrun by a malicious actor If anyone asides from the intended owner calls initialize, they automatically become the owner of this PaymentVault contract with the privileges required to call withdraw on any of the deposited tokens. Bots could be listening on the network for scenarios set up just like this and take advantage of the exploit opportunity. Once the attacker is approved, they can set the owner to an auto-drain contract that immediately removes any deposits made into the vault. This could defeat the goal of having the contract act as a vault until needed. Scenario 2: Initialize does not get called by anyone This would make the owner variable set to address(0), and the withdraw function will be unusable since address(0) currently does not have a signer and cannot pass the onlyOwner check.
Open the reportHighOwnership and Privilege transferdApplooker · QuillAudits · 20 Mar 2023Fixed
If renouncing ownership is not done appropriately, the current contract owner can renounce ownership, lose owner privileges, and lose access to the tokens sent to the contract forever. When ownership is renounced, functions like withdraw will be uncallable and any tokens gotten from transactions, or even mistaken deposits into the contract will be inaccessible.
Open the reportMediumOnly owner can make withdrawalsdApplooker · QuillAudits · 20 Mar 2023Fixed
The current logic of this contract allows only the owner to withdraw deposited tokens. This means User A can make a deposit but would never be able to withdraw their deposited tokens unless they were the deployers of the contract and/or the caller of the initialize function.
Open the reportLowEvent emissiondApplooker · QuillAudits · 20 Mar 2023Fixed
The events emitted in the contract could be indexed to allow for easy searching for addresses that made deposits and the different tokens that were added in.
Open the reportLowUnlocked pragmadApplooker · QuillAudits · 20 Mar 2023Fixed
The solidity pragma version in this codebase is unlocked.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="dapplooker"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us