Indorse 2.0 Ecosystem security record
As of 2 Nov 2026, Indorse 2.0 Ecosystem has 1 audit report on Trustblock, by QuillAudits, dated 1 Sep 2023. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Indorse | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Findings18
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 7 | 0 | 10 |
HighMissing unit testsIndorse · QuillAudits · 1 Sep 2023Open
It is highly recommended to have above 95% of code functionality tested before going into production so as to catch bugs that could be introduced from user input as well as return values from function calls.
Open the reportLowArray operation optimizationIndorse · QuillAudits · 1 Sep 2023Open
In a bid to save gas, calldata is preferred over memory, especially in user-supplied arrays that are looped over. Since the array content is not modified, the function parameters can be declared as calldata instead of memory.
Open the reportLowArray update patternIndorse · QuillAudits · 1 Sep 2023Open
The array is totally replaced without noting that the owner array is completely rewritten with every setOwners() call and not appended. [low]
Open the reportLowenable() and disable() in validators do not emit eventsIndorse · QuillAudits · 1 Sep 2023Open
The ECDSAValidator does not emit an event for disabling validators. Monitoring processes would be easier to perform if logs were generated for account deletion.
Open the reportLowError handlingIndorse · QuillAudits · 1 Sep 2023Open
Custom errors can be used to reduce gas costs for returning long strings. They are usually cheaper than string reverts.
Open the reportLowLogic in validateSignature() can be reused within validateUserOp()Indorse · QuillAudits · 1 Sep 2023Open
The function validateSignature() tries to recover data using the ECDSA scheme for hashed data and user-inputted data as well. The same happens in validateUserOp within the SessionKeyValidator, MultiECDSAValidator and ECDSAValidator. The repeated code can be reduced and
Open the reportLowNaming conventionIndorse · QuillAudits · 1 Sep 2023Open
There are multiple mentions of zerodev.kernel in the codebase. Understandably, this is a fork of the zerodev project but these portions of the codebase can be refactored as there are no hardcoded calculations making strict use of the storagePosition formed by hashing the string “zerodev.kernel”.
Open the reportLowRepeated addresses can cost extra gas when iterating over owners arrayIndorse · QuillAudits · 1 Sep 2023Open
When setOwners in MultiECDSAKernelFactory is called, it passes an array of addresses but does not check whether the addresses passed are unique. Non-unique addresses can unnecessarily increase the length of the array thereby increasing the number of times the loop has to run.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="indorse"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us