Diamante security record

BNB Chain, Ethereumdiamante.ioXGitHub

As of 1 Nov 2026, Diamante has 1 audit report on Trustblock, by CertiK, dated 3 Apr 2024. That report lists no open critical findings.

Critical findings
No open critical findings
In 1 report.
Open the latest report
Your label, live
Get the label for your site

Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.

Audits1

Newest first

AuditSecurity firmDateScopeCritical findingsReport
Diamante NetSecurity firm: CertiKDate: Scope: Files named in the reportNo open critical findingsOpen · skynet.certik.com

Findings4

Statuses are the security firm’s own, from each report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low400
LowInsufficient Use of EIP712 and ECDSA in `mint()`Diamante Net · CertiK · 3 Apr 2024Open

The `mint()` function in the `Diam` contract does not fully utilize the EIP712 standard and the ECDSA library already imported through the `ERC20Permit` inheritance, leading to potential signature malleability issues and a lack of distinction between signatures provided for the `mint()` and `permit()` functions. The `mint()` function should construct a structhash for the `mint()` function and use `ECDSA.recover()` for signature verification, similar to the methods used in `permit()` within `ERC20Permit`. An attacker could exploit the lack of signature malleability checks to forge signatures and mint tokens without authorization. The current implementation of the `mint()` function uses a manual construction of the message digest and `ecrecover` for signature verification. This approach lacks the security checks provided by `ECDSA.recover()` and does not fully employ methods recommended in [EIP-712](https://eips.ethereum.org/EIPS/eip-712).

Open the report
LowRecover Address Signer Can Be ZeroDiamante Net · CertiK · 3 Apr 2024Open

The function `ecrecover()` can return zero, and this can lead to a vulnerability as the address of the signer is not checked properly. By default, this issue is impossible to happen because of the below validation, and the `owner()` will not be `address(0)` in the known blockchains. ```solidity=60 require(signer == owner(), "DW02"); ``` This finding is to remind that the team should check if `address(0)` account of the blockchain, on which the `Diam` contract will be deployed, is held by any user on that blockchain. If ownership is ever renounced however, minting is immediately vulnerable to anyone minting any value. This is not ideal because the likely intention behind renouncing ownership would be to make it impossible to mint more tokens.

Open the report
LowUnnecessary Use of SafeMathDiamante Net · CertiK · 3 Apr 2024Open

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow. ```solidity=9 using SafeMath for uint256; ``` - `SafeMath` library is used for `uint256` type in `Diam` contract.

Open the report
LowUse of `abi.encodePacked`Diamante Net · CertiK · 3 Apr 2024Open

As a general practice, use of `abi.encodePacked` is discouraged, since it is susceptible to hash collisions in some instances where dynamically-sized inputs are used consecutively.

Open the report

Contracts

No deployed address is recorded for these audits.

The reports name a repository or files. Open a report to see its scope.

The repositories and files the reports name

Show this on your site

Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.

Content

Facts

Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.

Fixed as
Language

Style

Layout
Theme
Accent
Corners

Format

Size
Date
Embed as
HTML
<head>
<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
</head>
<body>
<div
data-tb-project-widget
data-tb-project-slug="diamante"
></div>
</body>

Paste the code where the label should appear. It uses no API credit and updates by itself.

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us