As of 3 Nov 2026, Everyworld has 1 audit report on Trustblock, by Quantstamp, dated 5 May 2023. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Everyworld | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 0 | 3 |
The new token mapper utilizes the [FxPortal](https://wiki.polygon.technology/docs/develop/l1-l2-communication/fx-portal/) for ERC20 transfers. The client plans to use the default FxPortal tunnel implementation as there is no custom FXPortal implementation present in the codebase. Since the default FXPortal implementation is being used, the token needs to be minted on the Root chain first. Upon the first usage of the deposit function, the child contract is [created](https://github.com/0xPolygon/fx-portal/blob/main/contracts/examples/erc20-transfer/FxERC20RootTunnel.sol#L79) on the [child chain](https://github.com/0xPolygon/fx-portal/blob/main/contracts/examples/erc20-transfer/FxERC20RootTunnel.sol#L71-L93). Therefore, all tokens need to be minted on the root chain before transfers can occur. However, the deployment described in the `README.md` is incompatible with the procedure required for the default FxPortal tunnel implementation for ERC20 transfers.
Open the reportAn [important bug](https://blog.soliditylang.org/2022/09/08/storage-write-removal-before-conditional-termination/) was identified in Solidity `0.8.16`. This is the version being used by the contract in scope.
Open the reportDuring deployment of the `Token` contract, the addresses within `_mintAddresses` are validated to ensure the receiving address of the mint is not the zero address. This is redundant since `ERC20._mint()` already performs the same validation.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="everyworld-1"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us