Biconomy security record
As of 10 Nov 2026, Biconomy has 4 audit reports by 2 security firms on Trustblock; the latest is by Pashov Audit Group, dated 14 May 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits5
Newest first
| Report | Security firm | Date | Scope | Critical findings | Source |
|---|---|---|---|---|---|
| Biconomy security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Biconomy security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| BiconomyComposability security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded; see the report | 1 critical finding, fixed | GitHub ↗ |
| BiconomyNexus security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| nexus-PR214 | Security firm: Cantina | Date: | Scope: Not recorded; see the report | None open | cantina.xyz ↗ |
Findings38
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 6 | 23 |
Marked Informational or Gas Optimization by the firms. Not counted as findings.
InformationalChange in ERC7739 magic number can break things when ERC7739 standard gets updatednexus-PR214 · Cantina · 20 Nov 2024Fixed
The report gives no description here.
Open the reportGas OptimizationisValidSignature() in Nexus.sol can be optimized for cases when the call is not a ERC7739 detection requestnexus-PR214 · Cantina · 20 Nov 2024Fixed
The report gives no description here.
Open the reportInformationalNewer version of solady's ECDSA library availablenexus-PR214 · Cantina · 20 Nov 2024Fixed
The report gives no description here.
Open the reportInformationalNexus deviates from ERC1271 reference implementationnexus-PR214 · Cantina · 20 Nov 2024Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="hyphen"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us