Kresus Lab security record
As of 3 Nov 2026, Kresus Lab has 2 audit reports by 2 security firms on Trustblock; the latest is by Hacken, dated 18 Apr 2023. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Kresus / Wallet | Security firm: Hacken | Date: | Scope: Files named in the report | No open critical findings | Open · hacken.io |
| Kresus Lab | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Findings56
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 0 | 6 |
| Medium | 3 | 0 | 5 |
| Low | 7 | 0 | 33 |
HighRequirements ViolationKresus / Wallet · Hacken · 18 Apr 2023Open
The report gives no description here.
Open the reportHighAnyone can burn tokensKresus Lab · QuillAudits · 6 Feb 2023Open
The functions burn() and burnBatchToken() in KresusNFT.sol are unprotected.KresusNFT.sol lines 148-171 this implies that anyone can call these functions directly on KresusNFT passing in the Proxy address, ids of assets held by proxy and burn the token(s) held by Proxy.
Open the reportMediumPossible False-Negative ValidationKresus / Wallet · Hacken · 18 Apr 2023Open
The report gives no description here.
Open the reportMediumUnclear BehaviorKresus / Wallet · Hacken · 18 Apr 2023Open
The report gives no description here.
Open the reportMediumCentralization Risks / Overpowered OwnershipKresus Lab · QuillAudits · 6 Feb 2023Open
It is not clear in documentation if the Proxy contract will make use of decentralised control such as MultiSig. Admins can perform privileged activities. The admin has centralised control to mint, burn, migrate and update Kresus NFT contract. If the admin roles are compromised this can have an impact on working of the projects.
Open the reportLowConversion From Bytes32 to Uint256Kresus / Wallet · Hacken · 18 Apr 2023Open
The report gives no description here.
Open the reportLowMissing EventsKresus / Wallet · Hacken · 18 Apr 2023Open
The report gives no description here.
Open the reportLowMissing Zero Address ValidationKresus / Wallet · Hacken · 18 Apr 2023Open
The report gives no description here.
Open the reportLowInput array lengths not all checked for length equalityKresus Lab · QuillAudits · 6 Feb 2023Open
KresusNFT.sol line 115 states the following • - Lengths of `_assetIds`, `_tokenURIs` and `_amounts` must be equal. The only check made is require(_amounts.length == _tokenURIs.length, "Kresus NFT: Inconsistent lengths"); however _assetIds are not checked against the other input array sizes .
Open the reportLowMissing address verification/Zero address checksKresus Lab · QuillAudits · 6 Feb 2023Open
Certain functions lack a safety check in the address, the address-type argument should include a zero-address test, otherwise, the contract's functionality may become inaccessible, tokens sent to invalid addresses, tokens may be burned in perpetuity or code may behave unexpectedly.
Open the reportShow 2 more
LowMissing eventsKresus Lab · QuillAudits · 6 Feb 2023Open
The missing event makes it difficult to track off-chain and impact off-chain monitoring and incident response functionality. An event should be emitted for significant functionality change, admin related changes to ensure transparency and tracking.
Open the reportLowUnnecessary use of overrideKresus Lab · QuillAudits · 6 Feb 2023Open
Functions in KresusNFT.sol mint(), bulkMint(),burnToken(), burnBatchToken(), batchTransfer(), updateProxyAddress() make use of the override keyword. This is not necessary as contract functions are not overriding any functionality from inherited contracts.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="kresus-lab"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us