IRIS Network security record
As of 3 Nov 2026, IRIS Network has 2 audit reports by 1 security firm on Trustblock; the latest is by CertiK, dated 1 Mar 2024. Those reports list 1 open critical finding. It also holds 1 deployed contract on 1 chain.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| BEP20 Contract for IRISnet Token (IRIS) | Security firm: CertiK | Date: | Scope: 1 address on BNB Chain | No open critical findings | Open · skynet.certik.com |
| ICS-721 Implementation (Golang) | Security firm: CertiK | Date: | Scope: Files named in the report | 1 open critical finding | Open · skynet.certik.com |
Findings25
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 1 | 0 | 0 |
| High | 1 | 2 | 0 |
| Medium | 0 | 2 | 0 |
| Low | 13 | 0 | 6 |
HighCentralization Related RisksBEP20 Contract for IRISnet Token (IRIS) · CertiK · 1 Mar 2024Acknowledged
In the contract `BEP20Cosmos`, the role **Owner** has authority over the following functions: - function `mint()` Any compromise to the **Owner** account may allow a hacker to take advantage of this authority and mint an arbitrary amount of tokens.
Open the reportHighInitial Token DistributionBEP20 Contract for IRISnet Token (IRIS) · CertiK · 1 Mar 2024Acknowledged
All of the `IRIS` tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the anonymous deployer can distribute tokens without obtaining the consensus of the community. Any compromise to the deployer account that holds undistributed tokens may allow the attacker to steal and sell tokens on the market, resulting in severe damage to the project.
Open the reportMediumSolidity Version Not RecommendedBEP20 Contract for IRISnet Token (IRIS) · CertiK · 1 Mar 2024Acknowledged
Solidity frequently releases new compiler versions with improved security features and bug fixes. Using an outdated version prevents access to these enhancements and may leave the smart contract vulnerable to known issues. ```solidity pragma solidity 0.5.16; ```
Open the reportMediumClass ID Could Be Incorrectly Parsed If It ContaiICS-721 Implementation (Golang) · CertiK · 1 Nov 2023Acknowledged
Files: - `types/trace.go` Commits: - [`cfc058309adcf73478d3828a524ecf8e546420ed`](https://github.com/bianjieai/nft-transfer/tree/cfc058309adcf73478d3828a524ecf8e546420ed) - [`87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba`](https://github.com/bianjieai/nft-transfer/tree/87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba) - [`fa7bd3f3cb1ebe24f781953a781add96509b4c2a`](https://github.com/bianjieai/nft-transfer/tree/fa7bd3f3cb1ebe24f781953a781add96509b4c2a) The `rawClassID` is converted to class trace by splitting with the separator `/` in the function `ParseClassTrace()`, which creates a new string slice of `classSplit`. The `Path` and `BaseClassId` are determined by the position in the string slice. ```go=67 func ParseClassTrace(rawClassID string) ClassTrace { classSplit := strings.Split(rawClassID, "/") if classSplit[0] == rawClassID { return ClassTrace{ Path: "", BaseClassId: rawClassID, } } return ClassTrace{ Path: strings.Join(classSplit[:len(classSplit)-1], "/"), BaseClassId: classSplit[len(classSplit)-1], } } ``` It works fine if there is no "/" in the input, `rawClassID`. In case that the `rawClassID` contains "/", it could be an issue with this splitting method. For example, the following class trace parsing could occur: > e.g. "class-1/2" => ClassTrace{Path: "class-1", BaseClassId: "2"} which would impact the following usage of the class trace and lead to the collision of class trace afterwards. Note that there is no restriction in the ADR nft modules in [`ADR-043`](https://github.com/cosmos/cosmos-sdk/blob/main/docs/architecture/adr-043-nft-module.md#nft). Additionally, it should not restrict the classID with "/", because the `voucherClassID` could be constructed with prefix `ibc/` during the interchain NFT transfer. Then the voucher NFT will be minted in the upper level NFT modules. **Reference**: - https://github.com/cosmos/cosmos-sdk/blob/main/docs/architecture/adr-043-nft-module.md#nft
Open the reportContracts1
| Address | Chain | Source code |
|---|---|---|
| 0x05c50a62b0b87be1ffb1cf3b77d9edba834ef6f7 | Chain: BNB Chain | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="iris-network"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us