Flow.com security record
As of 30 Oct 2026, Flow.com has 1 audit report on Trustblock, by Quantstamp, dated 25 Feb 2026. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Flow Core Contract | Security firm: Quantstamp | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · certificate.quantstamp.com |
Findings1
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 0 | 1 |
LowLoose hex prefix check in `addressFromString` allows silent address misinterpretationFlow Core Contract · Quantstamp · 25 Feb 2026Fixed
`addressFromString()` detects the `0x` prefix by only checking the second character (`asHex[1] == "x"`), not the first. A 42-character string where the second character is "x" but the first is not "0" (e.g., "Ax...", "1x...") will have its first two characters silently stripped, producing a valid but unintended 20-byte address. ```cadence var withoutPrefix = (asHex[1] == "x" ? asHex.slice(from: 2, upTo: asHex.length) : asHex).toLower() ``` Separately, a 42-character input where `asHex[1] != "x"` passes the full string to `decodeHex()`, producing 21 bytes. The subsequent `toConstantSized<[UInt8; 20]>()` returns `nil`, and the force-unwrap (`!`) panics with a generic runtime error rather than the function's own descriptive precondition message.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="flow-3"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us