As of 3 Nov 2026, Icplaza has 2 audit reports by 1 security firm on Trustblock; the latest is by CertiK, dated 17 Oct 2022. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 3 | 0 |
| Medium | 0 | 0 | 2 |
| Low | 1 | 1 | 14 |
`_hashUsed` is used to prevent repetitive call of the same function as a reaction to the same transactions. However, in `burnLock()` the check is done, but the mapping is not updated. This practically disables the protection.
Open the report```go=41 fee := authBiz.Price count := authBiz.Amount.Amount.Quo(authBiz.Price.Amount) if count.LT(sdk.OneInt()) { return rc } if count.Equal(sdk.OneInt()) { fee = authBiz.Amount } ``` Since the result of the `Quo()` method yields the floor value of the division result, the `if` statement on line 47 is not necessary. This may cause the actual fee to be greater than the due amount.
Open the report`IERC20` interface is not relevant to ERC20 standard.
Open the report`onlyMiner` modifier is supposed to be `onlyMinter`.
Open the reportCode commented in Chinese.
Open the reportThe linked declarations do not conform to the [Solidity style guide](https://solidity.readthedocs.io/en/v0.7.3/style-guide.html#naming-conventions) with regards to its naming convention. `public` functions and state fields names should not start with `_`.
Open the report`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.
Open the reportAddresses should be checked before assignment or external call to make sure they are not zero addresses.
Open the reportA reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. `mint()`, `lock()`, `burnLock()`, `freeLock()` update the state or emit events after the external call.
Open the reportThe return value of the `transfer()/transferFrom()` call is not checked.
Open the reportVariable `_minters` in `TRONChannel` is never used in `TRONChannel`.
Open the reportThe linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the report```go=95 func (k Keeper) WithdrawAuthorization(ctx sdk.Context, granteeAddr, authorizerAddr sdk.AccAddress, bizName string) (sdk.Coin, error) { return sdk.NewInt64Coin(sdk.DefaultBondDenom, 0), sdkerrors.Wrap(sdkerrors.ErrNotSupported, "Withdrawing authorization do not implement") } ``` The function `withdrawAuthorization()` just returns an error. We have the following speculations about it. 1. The business logic does not allow the user to withdraw authorization. However, the `withdrawAuthorization()` function should be implemented here for other reasons. 2. This function is incomplete.
Open the report```go=83 if err := k.bankKeeper.SendCoinsFromAccountToModule(ctx, granteeAddr, types.ModuleName, sdk.NewCoins(fee)); err != nil { return err } ``` Consider that the grantee will transfer some coins to a module address in the `ReqAuthorization()` method. Is this operation used to buy something? For example, a module-issued coin, a community governance voucher, or something else. ```go func (k Keeper) consumeAuthorization(ctx sdk.Context, authBiz *types.AcqBiz) (bool) { rc := false fee := authBiz.Price ...... authBiz.Amount = authBiz.Amount.Sub(fee) ...... if err = k.bankKeeper.SendCoinsFromModuleToAccount(ctx, types.ModuleName, authorizerAddr, sdk.NewCoins(fee)); err != nil { return rc } ``` Also, in the `consumeAuthorization()` method, the coins from `authBiz` will be split into two parts, one part will be used to purchase the authorizer as `fees` and the other part will stay in `authBiz`. Then what happens to the remaining `authBiz.Amount` coins? Will they be returned to the grantee, or will they stay for the next use? We may have a different understanding of this project, and we hope to bridge this gap so that our understanding is correct.
Open the reportThe codes in linked positions are never used.
Open the reportThe returned `error` is unhandled in linked positions.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="icplaza"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us