Exactly WebAuthn Owner Plugin security record
As of 23 Oct 2026, Exactly WebAuthn Owner Plugin has 1 audit report on Trustblock, by Quantstamp, dated 8 Jul 2024. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Exactly WebAuthn Owner Plugin | Security firm: Quantstamp | Date: | Scope: Repository at commit 7fcf594 | No open critical findings | Open · certificate.quantstamp.com |
Findings8
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 4 | 2 | 1 |
MediumIncorrect Implementation of `updateOwnersPublicKeys()`Exactly WebAuthn Owner Plugin · Quantstamp · 8 Jul 2024Fixed
The `updateOwnersPublicKeys()` function of the `WebauthnOwnerPlugin` contract needs to be adjusted or can be improved as follows: 1. When an owner is removed from the owner array, it is either replaced by a new owner or the last owner in the array. In either case, the `ownerCount` is decreased by one, which shouldn't be the case if a new owner replaces the removed owner. The redundant decrease of the owner array length could cause some owners to be removed unexpectedly. 2. When a new owner replaces a removed owner, the new owner is not validated and, therefore, could contain an invalid public key or be a duplicate of an existing owner in the array. 3. The `for` loop that iterates the `ownersToRemove` array breaks when the size of the owner array is reduced to zero. As a result, some elements in `ownersToRemove` are not used but are still logged in the `OwnerUpdated()` event, which could cause inconsistency between off-chain monitoring tools and the on-chain state. 4. When adding a new owner with `owner.y == 0`, validate that `owner.x <= type(uint160).max`. Although the same check is performed in the `_validateSignature()` function, validating user input as early as possible is best practice.
Open the reportLowRemove Possibility of Adding Malformed AddressesExactly WebAuthn Owner Plugin · Quantstamp · 8 Jul 2024Fixed
Currently `_validateSignature()` performs the following check: `owner.x > type(uint160).max`. This allows the system to verify that this is a valid address stored. It is a good practice to not allow for invalid addresses to be added in the first place, so this check should be performed at installation or owner update calls to avoid having invalid addresses altogether.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="exactly-webauthn-owner-plugin"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us