As of 3 Nov 2026, Galileo has 3 audit reports by 2 security firms on Trustblock; the latest is by QuillAudits, dated 25 Dec 2024. Those reports list 1 open critical finding. It also holds 1 deployed contract on 1 chain.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Galileo Protocol | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| Galileo Protocol / GalileoStaking | Security firm: Hacken | Date: | Scope: 1 address on Ethereum | 1 open critical finding | Open · hacken.io |
| Galileo Protocol / Marketplace + Escrow | Security firm: Hacken | Date: | Scope: 1 address on Ethereum | 2 open critical findings | Open · hacken.io |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 1 | 0 | 1 |
| High | 0 | 0 | 4 |
| Medium | 0 | 0 | 3 |
| Low | 4 | 0 | 11 |
The report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe _recover function uses EIP-712 typed data hashing to generate a digest for recovering the signer from a provided signature. However, the chain ID is not included in the hashed data. This omission allows the same signature to be reused (replayed) on other EVM-compatible chains that share the same contract address and data structure, potentially causing unintended actions.
Open the reportThe _stakeTokens function allows users to stake NFTs with a token ID of 0. However, unstaking of token ID 0 is disallowed, leading to an inconsistency in the staking logic. If a user stakes a token with ID 0, they might face issues retrieving their NFT later, as the unstaking functionality does not account for this scenario
Open the reportThe report gives no description here.
Open the reportThe comment in the configureNewCollection function inaccurately describes the logic of the if block. Specifically, it states: // Ensure that maxLeox does not decrease compared to the previous tier However, the implementation actually enforces that maxLeox values must decrease (i.e., be in descending order) compared to the previous tier. This discrepancy between the comments and the logic leads to confusion, as it contradicts the intention verified in the written tests.
Open the reportThe current implementation of the stake and _stakeTokens functions does not verify whether an emergency state has been declared. If the contract is in an emergency state, allowing users to stake tokens may result in undesirable behavior, such as locking funds in an unsafe environment or exposing the protocol to additional risks. Adding a check to ensure that staking is not permitted during emergencies would enhance security and user protection.
Open the reportThe stakeLeoxTokens function checks if the token is already staked by verifying the tokenId. However, this check can be bypassed by passing 0 as the tokenId. Since the tokenId field in the StakePerCitizen struct defaults to 0, the condition stakePerCitizen.tokenId != tokenId will evaluate as false, allowing the function logic to proceed. This creates an inconsistency and can potentially lead to staking logic being executed for an invalid token.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the report| Address | Chain | Source code |
|---|---|---|
| 0xa444…7ad50xa444ec96ee01bb219a44b285de47bf33c3447ad5 | Chain: Ethereum | Source code: Verified source |
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="galileo-protocol"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us