Lingo security record
As of 21 Oct 2026, Lingo has 2 audit reports by 2 security firms on Trustblock; the latest is by Cantina, dated 14 Apr 2025. Those reports list no open critical findings. It also holds 1 deployed contract on 1 chain.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| lingoToken | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | 3 critical findings, fixed | Open · cantina.xyz |
| Lingo / Token + Vesting + Staking | Security firm: Hacken | Date: | Scope: 1 address on Base | No open critical findings | Open · hacken.io |
Findings14
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 3 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 10 |
CriticalAttacker can become the authority of the config accountlingoToken · Cantina · 14 Apr 2025Fixed
The report gives no description here.
Open the reportCriticalInsufficient validations allow attackers to steal by increasing refundable fee amount without any transfer feeslingoToken · Cantina · 14 Apr 2025Fixed
The report gives no description here.
Open the reportCriticalMissing instruction to collect transfer fees accumulated in delegate_token_accountlingoToken · Cantina · 14 Apr 2025Fixed
The report gives no description here.
Open the reportMediumAny token account owned by delegate can be usedlingoToken · Cantina · 14 Apr 2025Fixed
The report gives no description here.
Open the reportLow[DualDefense] Fee Bypass Through Staking Contract Using Zero Locking DurationLingo / Token + Vesting + Staking · Hacken · 19 Dec 2024Fixed
The report gives no description here.
Open the reportLowdelete Keyword Usage Leaves Gaps in userPositions Array After UnstakeLingo / Token + Vesting + Staking · Hacken · 19 Dec 2024Fixed
The report gives no description here.
Open the reportLowInconsistencies Between Project Documentation and Contract ImplementationLingo / Token + Vesting + Staking · Hacken · 19 Dec 2024Fixed
The report gives no description here.
Open the reportLowInefficient Gas Usage Due to addInternalAccess() Invocation in ConstructorLingo / Token + Vesting + Staking · Hacken · 19 Dec 2024Fixed
The report gives no description here.
Open the reportLowInefficient Minting Pattern for Vesting TokensLingo / Token + Vesting + Staking · Hacken · 19 Dec 2024Fixed
The report gives no description here.
Open the reportLowLack of Minimum Stake Validation Can Lead to Array OverpopulationLingo / Token + Vesting + Staking · Hacken · 19 Dec 2024Fixed
The report gives no description here.
Open the reportShow 4 more
LowMissing Two-step Ownership Transfer ProcessLingo / Token + Vesting + Staking · Hacken · 19 Dec 2024Fixed
The report gives no description here.
Open the reportLowPotential Accounting Inconsistency Due to Fee Deduction in Staking TransactionsLingo / Token + Vesting + Staking · Hacken · 19 Dec 2024Fixed
The report gives no description here.
Open the reportLowPotential Front-Running Risk in Lock Duration UpdatesLingo / Token + Vesting + Staking · Hacken · 19 Dec 2024Fixed
The report gives no description here.
Open the reportLowViolation of the Checks-Effects-Interactions (CEI) patternLingo / Token + Vesting + Staking · Hacken · 19 Dec 2024Fixed
The report gives no description here.
Open the reportContracts1
| Address | Chain | Source code |
|---|---|---|
| 0xfb42da273158b0f642f59f2ba7cc1d5457481677 | Chain: Base | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="lingo"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us