Biconomy security record
As of 14 Oct 2026, Biconomy has 3 audit reports by 2 security firms on Trustblock; the latest is by Pashov Audit Group, dated 14 May 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Biconomy security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Biconomy security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| nexus-PR214 | Security firm: Cantina | Date: | Scope: Not recorded. See the report | No open critical findings | Open · cantina.xyz |
Findings19
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 17 |
HighIncorrect assembly packing in getNamespace causes collisionsBiconomy security review · Pashov Audit Group · 26 Nov 2025Fixed
The report gives no description here.
Open the reportMediumIn Nexus:checkERC7739Support() only the last validator is checked to determine if the smart account supports ERC7739nexus-PR214 · Cantina · 20 Nov 2024Fixed
The report gives no description here.
Open the reportLow_validateConstraints() may read beyond rawValue leading to zero-threshold issueBiconomy security review · Pashov Audit Group · 14 May 2026Fixed
The report gives no description here.
Open the reportLowBytes32(c.referenceData) accepts noncanonical encodings of constraint valuesBiconomy security review · Pashov Audit Group · 14 May 2026Fixed
The report gives no description here.
Open the reportLowEmpty OR constraints always fail without an explicit invalid-OR errorBiconomy security review · Pashov Audit Group · 14 May 2026Fixed
The report gives no description here.
Open the reportLowIn constraint silently misbehaves for signed reference dataBiconomy security review · Pashov Audit Group · 14 May 2026Fixed
The report gives no description here.
Open the reportLowNested-OR rejection is evaluation path dependent not structuralBiconomy security review · Pashov Audit Group · 14 May 2026Fixed
The report gives no description here.
Open the reportLowNo clean way to ignore some returned fieldsBiconomy security review · Pashov Audit Group · 14 May 2026Fixed
The report gives no description here.
Open the reportLowSigned constraints treat large positive values as negativeBiconomy security review · Pashov Audit Group · 14 May 2026Fixed
The report gives no description here.
Open the reportLowAssembly errors not declared in the interfaceBiconomy security review · Pashov Audit Group · 26 Nov 2025Fixed
The report gives no description here.
Open the reportShow 9 more
LowFree memory pointer not updatedBiconomy security review · Pashov Audit Group · 26 Nov 2025Fixed
The report gives no description here.
Open the reportLowInvalid EIP-712 Domain TypehashBiconomy security review · Pashov Audit Group · 26 Nov 2025Fixed
The report gives no description here.
Open the reportLowPREPInitialized event emitted but not declaredBiconomy security review · Pashov Audit Group · 26 Nov 2025Fixed
The report gives no description here.
Open the reportLowChange in ERC7739 magic number can break things when ERC7739 standard gets updatednexus-PR214 · Cantina · 20 Nov 2024Fixed
The report gives no description here.
Open the reportLowisValidSignature() in Nexus.sol can be optimized for cases when the call is not a ERC7739 detection requestnexus-PR214 · Cantina · 20 Nov 2024Fixed
The report gives no description here.
Open the reportLowisValidSignatureWithSender() also checks signature s value for ERC7739 support detection calls which is unnecessarynexus-PR214 · Cantina · 20 Nov 2024Fixed
The report gives no description here.
Open the reportLowNewer version of solady's ECDSA library availablenexus-PR214 · Cantina · 20 Nov 2024Fixed
The report gives no description here.
Open the reportLowNexus deviates from ERC1271 reference implementationnexus-PR214 · Cantina · 20 Nov 2024Fixed
The report gives no description here.
Open the reportLowWrong docs for isValidSignatureWithSender() in K1Validatornexus-PR214 · Cantina · 20 Nov 2024Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="hyphen"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us