Mantle Network security record
As of 30 Oct 2026, Mantle Network has 9 audit reports by 4 security firms on Trustblock; the latest is by MixBytes, dated 28 May 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits9
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Mantle Network fBTC Timelock security audit | Security firm: MixBytes | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Mantle Op-geth & Op-stack Diff Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Mantle V2 Solidity Contracts Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| Mantle OP-Geth Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 3 critical findings, fixed | Open · blog.openzeppelin.com |
| Mantle Node, Batcher, Proposer, and Tooling Increm | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Mantle Token and Bridge Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Mantle Network (Bridge Contracts) | Security firm: Quantstamp | Date: | Scope: Repository at commit d627d24 | No open critical findings | Open · certificate.quantstamp.com |
| Mantle security review | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Mantle Network (Token Migration) | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings99
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 5 |
| High | 0 | 4 | 3 |
| Medium | 0 | 5 | 13 |
| Low | 12 | 26 | 31 |
CriticalBVM_ETH and MNT Deposited in Messengers Can Be StolenMantle V2 Solidity Contracts Audit · OpenZeppelin · 16 Apr 2024Fixed
The report gives no description here.
Open the reportCriticalAttacker Can Get Infinite BVM_ETH Tokens to Drain the ProtocolMantle OP-Geth Audit · OpenZeppelin · 16 Apr 2024Fixed
The report gives no description here.
Open the reportCriticalPotential Insufficient Balance for SponsorshipMantle OP-Geth Audit · OpenZeppelin · 16 Apr 2024Fixed
The report gives no description here.
Open the reportCriticalWrong Cost AccountingMantle OP-Geth Audit · OpenZeppelin · 16 Apr 2024Fixed
The report gives no description here.
Open the reportCriticalElected TSS Nodes Can Act Without Any DepositMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportHighDefault Values & Out-of-Bounds Panics In Merkle Tree ImplementationMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportHighElected TSS Nodes Can Avoid Slashing By Having Insufficient DepositsMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportHighAdherence To Specification: `BIT` Holders Might Get Less `MNT`Mantle Network (Token Migration) · Quantstamp · 16 Jun 2023Fixed
The [proposal in BitDAO](https://snapshot.org/#/bitdao.eth/proposal/0x950dac4d5715b8aa8eab29c484b1c9dd0eed161141262b0425874f65be4d9f8e) states: > “The one-way token conversion ratio shall be set at 1 $BIT token to 1 $MNT token”. However, the `MantleTokenMigrator` contract computes the ratio based on `TOKEN_CONVERSION_NUMERATOR` and `TOKEN_CONVERSION_DENOMINATOR`, possibly not guaranteeing the 1:1 ratio.
Open the reportMediumMalicious Canceller Can Lock the SafeMantle Network fBTC Timelock security audit · MixBytes · 28 May 2025Fixed
The report gives no description here.
Open the reportMediumTimelockSafeGuard.cancel Not Whitelisted for Immediate ExecutionMantle Network fBTC Timelock security audit · MixBytes · 28 May 2025Fixed
The report gives no description here.
Open the reportShow 10 more
MediumTimelockSafeGuard.updateMinDelay Lacks Minimum and Maximum LimitsMantle Network fBTC Timelock security audit · MixBytes · 28 May 2025Fixed
The report gives no description here.
Open the reportMediumInefficient Error Handling and Timeout in loopEigenDa LoopMantle Op-geth & Op-stack Diff Audit · OpenZeppelin · 27 Feb 2025Fixed
The report gives no description here.
Open the reportMediumCross Domain Messengers Can Fail in Relaying a MessageMantle V2 Solidity Contracts Audit · OpenZeppelin · 16 Apr 2024Fixed
The report gives no description here.
Open the reportMediumGas Estimation Can Fail in finalizeWithdrawalTransactionMantle V2 Solidity Contracts Audit · OpenZeppelin · 16 Apr 2024Fixed
The report gives no description here.
Open the reportMediumUnnecessary Payable Function DefinitionMantle V2 Solidity Contracts Audit · OpenZeppelin · 16 Apr 2024Fixed
The report gives no description here.
Open the reportMediumData With Id 1 Cannot Be Retrieved From Mantle DAMantle Node, Batcher, Proposer, and Tooling Increm · OpenZeppelin · 16 Apr 2024Fixed
The report gives no description here.
Open the reportMediumIncorrect Error Returned With Empty SignatureMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportMediumLack Of Array Size Checks Before Slicing Or Referencing Array ElementsMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportMediumLack Of Signature Size Verification ChecksMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportMediumLack Of Size Checks In createUUID() FunctionMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportShow 10 more
MediumTSS Nodes Reporting Slashing Are Vulnerable To Front RunningMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportLowInconsistent role checking between schedule and scheduleSimple functionsMantle Network fBTC Timelock security audit · MixBytes · 28 May 2025Fixed
The report gives no description here.
Open the reportLowOperations with zero count can be scheduled but never executedMantle Network fBTC Timelock security audit · MixBytes · 28 May 2025Fixed
The report gives no description here.
Open the reportLowRevocable SAFE_ROLE Can Lock the Safe WalletMantle Network fBTC Timelock security audit · MixBytes · 28 May 2025Fixed
The report gives no description here.
Open the reportLowSingle Admin Can Freeze the SafeMantle Network fBTC Timelock security audit · MixBytes · 28 May 2025Fixed
The report gives no description here.
Open the reportLowTimelockSafeGuard.hashOperation Marked view Instead of pureMantle Network fBTC Timelock security audit · MixBytes · 28 May 2025Fixed
The report gives no description here.
Open the reportLowDuplication of RLP EncodingMantle Op-geth & Op-stack Diff Audit · OpenZeppelin · 27 Feb 2025Fixed
The report gives no description here.
Open the reportLowInadequate Handling of Single Large Data Frames in blobTxCandidatesMantle Op-geth & Op-stack Diff Audit · OpenZeppelin · 27 Feb 2025Fixed
The report gives no description here.
Open the reportLowRedundant Encoding and Decoding of Commitments in disperseEigenDaDataMantle Op-geth & Op-stack Diff Audit · OpenZeppelin · 27 Feb 2025Fixed
The report gives no description here.
Open the reportLowWrong Value Emitted in EventMantle V2 Solidity Contracts Audit · OpenZeppelin · 16 Apr 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowFragilely Shared PointerMantle OP-Geth Audit · OpenZeppelin · 16 Apr 2024Fixed
The report gives no description here.
Open the reportLowIncorrect Error MessageMantle OP-Geth Audit · OpenZeppelin · 16 Apr 2024Fixed
The report gives no description here.
Open the reportLowBridge Can Be ReinitializedMantle Token and Bridge Audit · OpenZeppelin · 18 Jul 2023Fixed
The report gives no description here.
Open the reportLowMisleading CommentsMantle Token and Bridge Audit · OpenZeppelin · 18 Jul 2023Fixed
The report gives no description here.
Open the reportLowMissing Input ValidationMantle Network (Bridge Contracts) · Quantstamp · 13 Jul 2023Fixed
It is important to validate input data even if they come from trusted sources to reduce human error: 1. `L1StandardBridge.initialize()` needs to validate `_l2TokenBridge` and `_l1BitAddress` against `address(0)` as well since there is no setter for them. 2. `L2StandardBridge.constructor()` needs to validate `_l2CrossDomainMessenger` and `_l1TokenBridge` against `address(0)` as well since there is no setter for them.
Open the reportLowHardcoded Addresses Of BIT TokenMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportLowhashAfterPops() Uses Incorrect LengthMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportLowIf TSS Nodes Fall Below Quorum Size No TSS Decisions Can Be MadeMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportLowMissing Zero Address Checks In Checkpoint OracleMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportLowMnemonic Cannot Be Used Without Supplying Private KeyMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowNil Pointer Panic If DTL Returns Malformed DataMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportLowSequencer Address Updates Can Immobilise ContractMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportLowTSS Node Clients Have Unreachable Max Connection Attempts LogicMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportLowTSS Node Design UncertaintyMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportLowTSS Nodes Can Report Themselves For Slashing To Reduce PenaltyMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportLowTSS Nodes Could Be Paid The Same Fee TwiceMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportLowUnhandled Panic If Metadata Is Set To NilMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportLowUnreachable Error Handling In Proxyd CacheMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportLowUnused Items in StructuresMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportLowWaitgroup Counter Not IncrementedMantle security review · Sigma Prime · 1 Jul 2023Fixed
The report gives no description here.
Open the reportShow 2 more
LowMissing Input ValidationMantle Network (Token Migration) · Quantstamp · 16 Jun 2023Fixed
It is important to validate inputs, even if they only come from trusted addresses, to avoid human error. The following is a non-exhaustive list of missing input validations: <br><br> 1. `MantleTokenMigrator.constructor()`: the `TOKEN_CONVERSION_NUMERATOR` has to be less than or equal to `TOKEN_CONVERSION_DENOMINATOR`. Additionally, the decimals of `BIT` and `MNT` tokens should be equal according to the NatSpec comments. 1. `MantleTokenMigrator.setTreasury()` needs a check against `address(0)`. Otherwise, the `defundContract()`, might just burn tokens.
Open the reportLowUnnecessary `receive()` and `fallback()` FunctionalityMantle Network (Token Migration) · Quantstamp · 16 Jun 2023Fixed
`MantleTokenMigrator` contract implements `receive()` and `fallback()` functions. Based on the documentation and project use cases, the contract does not need to receive ETH at any point. The implementation of the functions also shows the Mantle team's intention: to make the transaction revert when receiving ETH in this contract.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="mantle-network"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us