Hinkal security record
As of 30 Oct 2026, Hinkal has 1 audit report on Trustblock, by Quantstamp, dated 28 Aug 2026. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Hinkal Protocol - 2 | Security firm: Quantstamp | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · certificate.quantstamp.com |
Findings14
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 2 | 3 | 8 |
LowArbitrary Emporium Calls Allow Theft of Untracked AssetsHinkal Protocol - 2 · Quantstamp · 28 Aug 2026Acknowledged
`EmporiumUpgradeable.runAction()` executes the caller-supplied `stack.ops` as arbitrary calls from the Emporium contract. However, its balance checks only protect the caller-supplied `circomData.erc20TokenAddresses`. An attacker can submit a Min0 proof with no token rows and set `signerAddress` to `address(0)`, which requires no signature in `verifyWallet()`. The attacker can then use `stack.ops` to transfer residual ERC20 tokens or native ETH from Emporium. An empty token array prevents the resulting balance decrease from being checked. This allows anyone to steal assets accidentally transferred, donated, or stranded in Emporium. The attacker may also spend third-party assets through allowances previously granted by Emporium.
Open the reportLowNative ETH Sent without Matching `address(0)` Token Slot Is LostHinkal Protocol - 2 · Quantstamp · 28 Aug 2026Acknowledged
The accounting in `transact()` only properly includes `msg.value` into `balanceDif` upon encountering the `erc20TokenAddresses` set to `address(0)`. The circuit's pairwise uniqueness constraint ensures at most one `address(0)` slot. However, there is no checks for the case where the token set contains no native-ETH slot, but there are native tokens send along with the transaction. These would then be lost in the contract.
Open the reportLowProblematic Zero HashesHinkal Protocol - 2 · Quantstamp · 28 Aug 2026Acknowledged
`0` as a hash could be problematic and short-cut Merkle tree paths.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="hinkal-1"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us