Ethereum.org security record
As of 3 Nov 2026, Ethereum.org has 4 audit reports by 2 security firms on Trustblock; the latest is by ChainSecurity, dated 28 Sep 2023. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| EIP‑4788 | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| EIP-4337 – Ethereum Account Abstraction Incrementa | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| EIP-4337 | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| Serpent Compiler Audit | Security firm: OpenZeppelin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · blog.openzeppelin.com |
Findings45
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 7 |
| Medium | 2 | 0 | 2 |
| Low | 10 | 4 | 19 |
Critical[C01] Deposit manipulation [core]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportHighZero-Timestamp Can Be Queried SuccessfullyEIP‑4788 · ChainSecurity · 28 Sep 2023Fixed
The report gives no description here.
Open the reportHighInvalid aggregate signature [samples]EIP-4337 – Ethereum Account Abstraction Incrementa · OpenZeppelin · 1 Mar 2023Fixed
The report gives no description here.
Open the reportHigh[H01] Incorrect prefund calculation [core]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportHigh[H02] Duplicate validation gas accounting [core]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportHigh[H03] Paymasters can spend locked stake [core]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportHigh[H04] Token transfers may fail silently [sample]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportHigh[H05] Incorrect gas price [core]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportMedium[M01] Inconsistent behavior between ecrecover2 and ecrecover [sample]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportMedium[M02] Separate stake and prepayment [core]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowImplications of Ring Buffer SizeEIP‑4788 · ChainSecurity · 28 Sep 2023Fixed
The report gives no description here.
Open the reportLowAccounts cannot replace EntryPoint [samples]EIP-4337 – Ethereum Account Abstraction Incrementa · OpenZeppelin · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowGnosis safe reverts on signature failure [samples]EIP-4337 – Ethereum Account Abstraction Incrementa · OpenZeppelin · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowImprecise time range [core]EIP-4337 – Ethereum Account Abstraction Incrementa · OpenZeppelin · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowIncorrect or misleading documentation [core and samples]EIP-4337 – Ethereum Account Abstraction Incrementa · OpenZeppelin · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowMismatched event parameter [core]EIP-4337 – Ethereum Account Abstraction Incrementa · OpenZeppelin · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowMissing error messages in require statements [core and samples]EIP-4337 – Ethereum Account Abstraction Incrementa · OpenZeppelin · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowMissing recommended function [samples]EIP-4337 – Ethereum Account Abstraction Incrementa · OpenZeppelin · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowUninitialized implementation contract [samples]EIP-4337 – Ethereum Account Abstraction Incrementa · OpenZeppelin · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowUnrestrained revert reason [core]EIP-4337 – Ethereum Account Abstraction Incrementa · OpenZeppelin · 1 Mar 2023Fixed
The report gives no description here.
Open the reportShow 9 more
LowUnsafe ABI encodingEIP-4337 – Ethereum Account Abstraction Incrementa · OpenZeppelin · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLow[L02] Incorrect event parameter [core]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportLow[L04] Inconsistent minimum stake delay [core]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportLow[L05] Incorrect balance check comparison in TokenPaymaster [sample]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportLow[L06] handleOp function is redundant [core]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportLow[L07] Event misordering possibility [core]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportLow[L08] Paymasters cannot reduce unstaking delay after withdrawal window [core]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportLow[L13] Missing validations [core]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportLow[L14] DepositPaymaster warning [sample]EIP-4337 · OpenZeppelin · 19 Apr 2022Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="ethereum-1"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us