IDEX security record
As of 3 Nov 2026, IDEX has 1 audit report on Trustblock, by Quantstamp, dated 21 Jul 2020. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| IDEX | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings11
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 4 | 7 |
LowGas Usage / `for` Loop ConcernsIDEX · Quantstamp · 21 Jul 2020Acknowledged
The `loadAssetBySymbol` function inside `AssetRegistry.sol` contains a for-loop over all assets registered with the same symbol (see L100). If there are too many assets registered with the same symbol, this function would revert due to reaching the block-gas-limit. Although this is unlikely to be an issue in practice (the number of token contract update are likely to be small), in theory, reaching the gas-block-limit is still possible.
Open the reportLowPrivileged Roles and OwnershipIDEX · Quantstamp · 21 Jul 2020Acknowledged
Smart contracts will often have `owner` and/or `admin` roles to designate the person with special privileges to make modifications to the smart contract and/or other components (e.g., dispatcher wallet). However, this centralization of power needs to be made clear to the users, especially depending on the level of privilege the contract allows to the owner.
Open the reportLowSome Functions Lack Unit TestsIDEX · Quantstamp · 21 Jul 2020Acknowledged
All the functions in `Signatures.sol` and `AssetTransfers.sol` lack unit tests; however, we acknowledged that they are being indirectly checked by `deposit` and `withdraw` testing flows in the test suite. We suggest, nonetheless, having dedicated unit tests for all functions, testing different input combinations.
Open the reportLowToken De-registration Not PossibleIDEX · Quantstamp · 21 Jul 2020Acknowledged
Currently, after registering a new token, it cannot be de-registered. Thus, if an incorrect token registration occurs, it cannot be undone unless one performs a new contract deployment and migrates all correctly registered tokens.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="idex"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us