LOCUS CHAIN security record

As of 3 Nov 2026, LOCUS CHAIN has 1 audit report on Trustblock, by CertiK, dated 1 Dec 2022. That report lists no open critical findings. It also holds 1 deployed contract on 1 chain.

Critical findings
No open critical findings
In 1 report.
Open the latest report
Your label, live
Get the label for your site

Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.

Audits1

Newest first

AuditSecurity firmDateScopeCritical findingsReport
Locus Chain - AuditSecurity firm: CertiKDate: Scope: 1 address on EthereumNo open critical findingsOpen · skynet.certik.com

Findings14

Statuses are the security firm’s own, from each report.

SeverityOpenAcknowledgedFixed
Critical000
High010
Medium000
Low1300
Low`Approval` Event is not EmittedLocus Chain - Audit · CertiK · 1 Dec 2022Open

The function `transferFrom` deviate from the `ERC20` standard and does not emit `Approval` event for the changed allowance.

Open the report
LowDeclaration Naming ConventionLocus Chain - Audit · CertiK · 1 Dec 2022Open

Two declarations do not conform to the [Solidity style guide](https://solidity.readthedocs.io/en/v0.7.3/style-guide.html#naming-conventions) with regards to its naming convention. Particularly: - `camelCase`: Should be applied to function names, argument names, local and state variable names, modifiers - `UPPER_CASE`: Should be applied to `constant` variables - `CapWords`: Should be applied to contract names, struct names, event names and enums

Open the report
LowFunction Should Be Declared ExternalLocus Chain - Audit · CertiK · 1 Dec 2022Open

The functions which are never called internally within the contract should have external visibility for gas optimization.

Open the report
LowImplicit Return ValueLocus Chain - Audit · CertiK · 1 Dec 2022Open

```solidity=67 function approveAndCall(address _spender, uint _value, bytes _extraData) public returns(bool) { ``` - The function `approveAndCall` implicitly returns a default value.

Open the report
LowMissing Emit EventsLocus Chain - Audit · CertiK · 1 Dec 2022Open

Functions that update state variables should emit relevant events as notifications.

Open the report
LowMissing Error MessagesLocus Chain - Audit · CertiK · 1 Dec 2022Open

The **require** statement can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Open the report
LowMissing Zero Address ValidationLocus Chain - Audit · CertiK · 1 Dec 2022Open

The cited address input is missing a check that it is not `address(0)`.

Open the report
LowPotential Risk On `approve()`/`transferFrom()` MeLocus Chain - Audit · CertiK · 1 Dec 2022Open

Current Locus implementation is vulnerable to [a known ERC20 race condition issue](https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729), which could lead to token theft. When a user calls `approve()` for a second time on a spender that has already been allowed, the spender could call `transferFrom()` to transfer the previous value and still receive the authorization to transfer the new value. Exploit scenario: 1. Alice calls `approve(Bob, 100)` to allow Bob to spend 100 tokens. 2. Alice changes her mind and calls `approve(Bob, 50)`. 3. Bob observes the second `approve(Bob, 50)` function call and calls `transferFrom(Alice, Bob, 100)` before the second `approve(Bob, 50)` call. 4. The above scenario can be achieved by front-running. In this case, Bob can transfer another 50 tokens from Alice and in total, he transferred 150 tokens from Alice.

Open the report
LowRedundant `if` StatementLocus Chain - Audit · CertiK · 1 Dec 2022Open

The highlighted `if` statement will always equal `true` because the `approve()` function either reverts or returns true.

Open the report
LowToo Many DigitsLocus Chain - Audit · CertiK · 1 Dec 2022Open

Literals with many digits are difficult to read and review. ```solidity=15 uint internal constant initialSupply = 7000000000 * (10 ** uint(decimals)); ```

Open the report
Show 3 more
LowUnlocked and Outdated Compiler VersionLocus Chain - Audit · CertiK · 1 Dec 2022Open

The contracts cited have an unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging, as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one. Furthermore, the versions of Solidity allowed by the pragma statement are not recommended as they are considered old (0.4.x).

Open the report
LowUser-Defined GettersLocus Chain - Audit · CertiK · 1 Dec 2022Open

The linked functions are equivalent to the compiler-generated getter functions for the respective variables.

Open the report
LowVariable Can Be Declared as ImmutableLocus Chain - Audit · CertiK · 1 Dec 2022Open

The variable `tokenOwner` assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation, but will remain constant throughout the lifetime of a deployed contract. An advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they are not located in storage. Please note that `immutable` state variables were introduced in later Solidity releases. Therefore, in order to make use of it, a greater version of Solidity should be used.

Open the report

Contracts1

AddressChainSource code
0xc64500dd7b0f1794807e67802f8abbf5f8ffb054Chain: EthereumSource code: Verified source

Show this on your site

Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.

Content

Facts

Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.

Fixed as
Language

Style

Layout
Theme
Accent
Corners

Format

Size
Date
Embed as
HTML
<head>
<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
</head>
<body>
<div
data-tb-project-widget
data-tb-project-slug="locus-chain"
></div>
</body>

Paste the code where the label should appear. It uses no API credit and updates by itself.

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us