IguVerse IGU security record
As of 3 Nov 2026, IguVerse IGU has 1 audit report on Trustblock, by CertiK, dated 14 Oct 2022. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| IguVerse - Audit 1 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings12
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 1 |
| Medium | 0 | 0 | 0 |
| Low | 2 | 0 | 7 |
HighPossibility of Replay Attack for SignaturesIguVerse - Audit 1 · CertiK · 14 Oct 2022Fixed
The checked signed messages in `IgupToken.sol`, `TokenDistributor.sol`, and `Iguverse.sol` do not contain the function name or a domain separator. Not having the function name allows the signature to be reused if there is the same number of inputs and having no domain separator allows the signature to be reused on other contracts or chains. In particular, if the `minter` address in `IgupToken.sol` is the same as the `signer` address in `TokenDistributor.sol`, then the same signature can be used to `collect()` on both contracts.
Open the reportLowContract Does Not Send BNBIguVerse - Audit 1 · CertiK · 14 Oct 2022Fixed
In `execTransaction()`, if `ptFromContract` is the zero address, then `fromContractAmounts` of BNB are transferred to `ptFromContractRecievers`. However, the BNB being transferred is from the `msg.value` which is sent by an account not the contract.
Open the reportLowContract Is Given Approval For Every TokenIguVerse - Audit 1 · CertiK · 14 Oct 2022Fixed
The function `isApprovedForAll` gives approval to `address(this)` for any `owner`. This may allow the contract to transfer or burn any tokens without the approval of the `owner`.
Open the reportLowError MessageIguVerse - Audit 1 · CertiK · 14 Oct 2022Fixed
The error message for `mintTo()` only mentions the minter role, but the `owner` can also mint. Similarly, the error message for `transferTo()` only mentions the signer role, but the `owner` can also transfer.
Open the reportLowMissing ChecksIguVerse - Audit 1 · CertiK · 14 Oct 2022Fixed
In the file IguVerse.sol in the function `execTransaction()`: - If `ptFromAccount` is a nonzero BEP20 address, then `fromAccountAmounts` are transferred from `msg.sender` to `ptFromAccountReveivers`. However, it is never checked that the sum of the `fromAccountAmounts` is less than or equal to the balance of `msg.sender`. - If `ptFromContract` is a nonzero BEP20 address, then `fromContractAmounts` are transferred from `address(this)` to `ptFromContractReveivers`. However, it is never checked that the sum of the `fromContractAmounts` is less than or equal to the balance of `address(this)`.
Open the reportLowMissing require statementIguVerse - Audit 1 · CertiK · 14 Oct 2022Fixed
Since the `vestingAmount` also contains the `activationAmount`, it should always be greater than or equal to the `activationAmount`. In the function `addVestingEntries()`, there is no require statement to check whether in the newly added vesting entry, `activationAmount` is less than equal to the `vestingAmount`.
Open the reportLowUnchecked BEP-20 `transfer()`/`transferFrom()` CaIguVerse - Audit 1 · CertiK · 14 Oct 2022Fixed
The return value of the transfer()/transferFrom() call is not checked for `token` in `TokenDistributor.sol`.
Open the reportLowUsage of `transfer()`/`send()` for Sending BNBIguVerse - Audit 1 · CertiK · 14 Oct 2022Fixed
After [EIP-1884](https://eips.ethereum.org/EIPS/eip-1884) was included in the Istanbul hard fork, it is not recommended to use `.transfer()` or `.send()` for transferring BNB as these functions have a hard-coded value for gas costs making them obsolete as they are forwarding a fixed amount of gas, specifically `2300`. This can cause issues in case the linked statements are meant to be able to transfer funds to other contracts instead of EOAs.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="iguverse"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us