Lombard security record
As of 3 Nov 2026, Lombard has 4 audit reports by 3 security firms on Trustblock; the latest is by Sherlock, dated 26 Jun 2026. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Lombard mintlimit audit | Security firm: Sherlock | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lombard multipauser bridge audit | Security firm: Sherlock | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Liquid Bitcoin Lombard Finance | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lombard-approver | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · cantina.xyz |
Findings49
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 3 |
| Medium | 0 | 3 | 16 |
| Low | 0 | 3 | 23 |
Marked Warning, Info, Informational or Gas Optimization by the firms. Not counted as findings.
WarningPotential panicking due to arithmetic overflowLiquid Bitcoin Lombard Finance · Ackee Blockchain Security · 28 Mar 2025Acknowledged
The report gives no description here.
Open the reportWarningUnexpected behavior in vector boundariesLiquid Bitcoin Lombard Finance · Ackee Blockchain Security · 28 Mar 2025Acknowledged
The report gives no description here.
Open the reportWarningWeighted validator signaturesLiquid Bitcoin Lombard Finance · Ackee Blockchain Security · 28 Mar 2025Acknowledged
The report gives no description here.
Open the reportWarningBascule Initialization front-runningLiquid Bitcoin Lombard Finance · Ackee Blockchain Security · 28 Mar 2025Fixed
The report gives no description here.
Open the reportInfoCode quality can be improvedLiquid Bitcoin Lombard Finance · Ackee Blockchain Security · 28 Mar 2025Fixed
The report gives no description here.
Open the reportWarningDeprecated Cross Program Invocation callLiquid Bitcoin Lombard Finance · Ackee Blockchain Security · 28 Mar 2025Fixed
The report gives no description here.
Open the reportWarningFields might be uninitializedLiquid Bitcoin Lombard Finance · Ackee Blockchain Security · 28 Mar 2025Fixed
The report gives no description here.
Open the reportWarningInability to transfer BasculeData authorityLiquid Bitcoin Lombard Finance · Ackee Blockchain Security · 28 Mar 2025Fixed
The report gives no description here.
Open the reportWarningInability to transfer Config authorityLiquid Bitcoin Lombard Finance · Ackee Blockchain Security · 28 Mar 2025Fixed
The report gives no description here.
Open the reportInfoInaccurate commentLiquid Bitcoin Lombard Finance · Ackee Blockchain Security · 28 Mar 2025Fixed
The report gives no description here.
Open the reportShow 10 more
WarningTreasury might cause protocol not operationalLiquid Bitcoin Lombard Finance · Ackee Blockchain Security · 28 Mar 2025Fixed
The report gives no description here.
Open the reportWarningUnfinished code may trigger undesired behaviorLiquid Bitcoin Lombard Finance · Ackee Blockchain Security · 28 Mar 2025Fixed
The report gives no description here.
Open the reportInfoUnnecessary storage of the Bascule program in the Config accountLiquid Bitcoin Lombard Finance · Ackee Blockchain Security · 28 Mar 2025Fixed
The report gives no description here.
Open the reportWarningUnstakeRequest does not take fee into considerationLiquid Bitcoin Lombard Finance · Ackee Blockchain Security · 28 Mar 2025Fixed
The report gives no description here.
Open the reportInformationalAddressbook hiding not found BTC address behind a decoding errorLombard-approver · Cantina · 22 Jan 2025Fixed
The report gives no description here.
Open the reportGas OptimizationBabylon request are unmarshalled twice during their processingLombard-approver · Cantina · 22 Jan 2025Fixed
The report gives no description here.
Open the reportGas OptimizationExcessive resource consumption in validateUnstakingOutputsLombard-approver · Cantina · 22 Jan 2025Fixed
The report gives no description here.
Open the reportInformationalIncrease consistency in string comparison using EqualFoldLombard-approver · Cantina · 22 Jan 2025Fixed
The report gives no description here.
Open the reportInformationalNil pointer dereference and panic if staking key does not existLombard-approver · Cantina · 22 Jan 2025Fixed
The report gives no description here.
Open the reportGas OptimizationPerformance optimization when processing unstake notary sessionsLombard-approver · Cantina · 22 Jan 2025Fixed
The report gives no description here.
Open the reportShow 8 more
Gas OptimizationRedundant condition in BulkCreateUnstakesLombard-approver · Cantina · 22 Jan 2025Fixed
The report gives no description here.
Open the reportGas OptimizationRedundant condition in processMfaRequestLombard-approver · Cantina · 22 Jan 2025Fixed
The report gives no description here.
Open the reportInformationalRisk of updating a unstake for nothing in BulkCreateUnstakesLombard-approver · Cantina · 22 Jan 2025Fixed
The report gives no description here.
Open the reportInformationalTransaction output value will be truncated in logged error messageLombard-approver · Cantina · 22 Jan 2025Fixed
The report gives no description here.
Open the reportInformationalTypographical errorsLombard-approver · Cantina · 22 Jan 2025Fixed
The report gives no description here.
Open the reportInformationalUnstrict decoding of PSBT sign requestsLombard-approver · Cantina · 22 Jan 2025Fixed
The report gives no description here.
Open the reportInformationalUnused codeLombard-approver · Cantina · 22 Jan 2025Fixed
The report gives no description here.
Open the reportInformationalUse .Fatal instead of Fatalf for logging error messages that do not contain placeholdersLombard-approver · Cantina · 22 Jan 2025Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="lombard"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us