NFTonPulse security record
As of 3 Nov 2026, NFTonPulse has 1 audit report on Trustblock, by Quantstamp, dated 21 Jul 2023. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| NFTonPulse | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings25
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 1 |
| Medium | 2 | 1 | 3 |
| Low | 0 | 5 | 12 |
MediumVouchers Can Be FrontrunNFTonPulse · Quantstamp · 21 Jul 2023Acknowledged
Redeeming vouchers only requires that the signature of the voucher matches that of the creator of the voucher. The address the NFT is sent to is completely independent of the voucher. Therefore, any voucher can be used to mint an NFT to any address. Since all of the voucher's data will be available to the mempool when calling `redeem()`, a malicious actor could use the voucher before the user who created and sent the transaction with the voucher. In the case of `NFT721`, the original user's transaction will fail due to the ID specified already having been used. `NFT1155` transactions may also fail if the frontrunner mints the full amount in the voucher. Vouchers for `NFT1155` may also be reused if the first transaction did not claim the full amount.
Open the reportLowMistaken Bids Can Be Immediately AcceptedNFTonPulse · Quantstamp · 21 Jul 2023Acknowledged
If a user accidentally submits a bid that is larger than they desire, a sophisticated auction creator could accept the bid before the user can call `cancelBid()`.
Open the reportLowNFTs and Funds Are Not Sent to the MarketplaceNFTonPulse · Quantstamp · 21 Jul 2023Acknowledged
The marketplace does not require items to be transferred to it, whenever they are being listed for sales. A lister can simply send the NFT elsewhere, and when a buyer tries to place a buy order, the transaction will revert, since the original owner doesn't own the NFT anymore. This can cause the marketplace to be flooded with invalid orders Which will damage its user experience and reputation. On the other hands, bidders are not required to send their funds to the marketplace. Which means that at the time when an item owner wants to accept their bid, the bidder might not have enough funds to cover the cost. This will also cause the transaction to revert.
Open the reportLowOn-Transfer-Fee Tokens CompatibilityNFTonPulse · Quantstamp · 21 Jul 2023Acknowledged
Some ERC-20 tokens implement additional functionalities when are being transferred. Some of them subtract a fee in the transfer operation (i.e. when transferring 100 tokens, the receiver's balance will increase in 90 tokens, as 10 tokens were collected as fee).
Open the reportLowTokens Removed From Whitelist Can Still Be Used to Fulfill Existing Offers/bidsNFTonPulse · Quantstamp · 21 Jul 2023Acknowledged
Only whitelisted tokens can be used to create bids and offers. However, if a token used to create a bid or offer is removed from the whitelist by the owner, the offer or bid can still be accepted. Calls to the removed token may be harmful.
Open the reportLowWhitelisting too Many Tokens on Construction Will FailNFTonPulse · Quantstamp · 21 Jul 2023Acknowledged
A for loop is used to include tokens from a dynamic array in the whitelist. If there are too many tokens in the array, it is possible to run out of gas on deployment.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="nftonpulse"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us