Growt security record
As of 30 Oct 2026, Growt has 1 audit report on Trustblock, by QuillAudits, dated 24 Jan 2025. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Growt | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Findings7
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 1 | 0 | 5 |
MediumTotal Amount of token minted exceeds the expected total supplyGrowt · QuillAudits · 24 Jan 2025Fixed
Based on the excel sheet provided by the Growt team, total suppply of Growt tokens(6 decimals) isexpected to be 500000000000000 tokens. But calculations in the Vesting smart contract mints 500000003952000 tokens in end of 67th month.
Open the reportLowMissing and incorrect docstringsGrowt · QuillAudits · 24 Jan 2025Fixed
constructor, releaseTokens and getAvailableTokenAmount functions miss some parts of docstrings.@param and @return tags provide rich documentation for functions about their parameters and return variables. getAvailableTokenAmount function's @dev tag is misleading because it just returns the available number of tokens for a receiver. /** * @dev Function let release available tokens //@audit misleading explanation */ function getAvailableTokenAmount (uint8 vestingPeriod_, address receiver) public view re turns(uint256) {
Open the reportLowMissing Event emissionGrowt · QuillAudits · 24 Jan 2025Fixed
releaseTokens function in the contract, mints new tokens to certain addresses stored in the contract.Therefore it is making state changes. State changing functions should emit events which is a best smart contract code practice. Release event is defined in the contract but never used in the funtion. event Release( address indexed userAddress, uint256 amount );
Open the reportLowMissing zero address checksGrowt · QuillAudits · 24 Jan 2025Fixed
constructor of the contract is missing to check the input address params are not zero address.- preSeed_- team_ - marketing_ - liquidity_ - marketMaking_ - airDrop_ - preSeedReward_ - reserve_
Open the reportLowUse !=0 instead of >0Growt · QuillAudits · 24 Jan 2025Fixed
In releaseTokens function, Growt tokens are minted after checking the amount of tokens is more thanzero It is cheaper to use != 0 than > 0 for uint256 values .
Open the reportLowUse standard time literals for better readabilityGrowt · QuillAudits · 24 Jan 2025Fixed
MONTH constant in the contract is not using the standard solidity [time units].(https://docs.soliditylang.org/en/latest/units-and-global-variables.html#time-units)Recommendation Resolved uint32 internal constant MONTH = 30 * 24 * 3600; // @audit use standard time units for better readability
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="growt"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us