Incident
Incident,
Source: De.Fi incident database.
- Audits before it
- 1.
- Audits since
- None on Trustblock.
Nomad security record
As of 14 Oct 2026, Nomad has 1 audit report on Trustblock, by Quantstamp, dated 6 Jun 2022. That report lists no open critical findings. It also holds 1 incident (latest 31 Jul 2022).
Critical findings
No open critical findings
In 1 report.
Incident
Incident 31 Jul 2022
Source: De.Fi incident database. No audit on Trustblock is dated after it. See the incident
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Nomad | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings40
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 2 | 0 | 4 |
| Low | 4 | 24 | 5 |
MediumLong Queues Can Lead To Denial Of ServiceNomad · Quantstamp · 6 Jun 2022Not fixed
Whenever the `update` method in the `Home` contract is called, it will validate if the queue contains the new root. However, the queue `contains` method does a linear scan of all the items in the queue. If the root has not been updated in a long time (either mistakenly or maliciously), the queue might have too many items, causing the `contains` method to throw an `Out of Gas` exception.
Open the reportMediumWatcher Availability ConcernNomad · Quantstamp · 6 Jun 2022Not fixed
Nomad architecture assumes the liveness of the watcher running on top of it to secure the Dapp running on top of it. We need the watcher to unroll from the replica within 30 minutes. Therefore, the availability of the watcher is critical. The current deployment is only configured with a single watcher, which concerns the availability of any hardware incident that occurs.
Open the reportLowAbusing UnderflowNomad · Quantstamp · 6 Jun 2022Not fixed
The `Encoding.sol:L52` abuses underflow to run the for-loop. The looping variable `i` starts from 15 and decreases one by one until it gets underflow and becomes 255 to break the for-loop. The underflow mechanism will work for solidity versions before 0.8.0 as solidity 8 introduces the safe math check into the run time. Nonetheless, the `pragma` definition of the contract is `>=0.6.11`, which means it can potentially be deployed with a version higher than 0.8.0.
Open the reportLowBridgeRouter Must Be The Owner Of The TokenRegistry To WorkNomad · Quantstamp · 6 Jun 2022Not fixed
During its operation, the `BridgeRouter` contract calls the `ensureLocalToken` and `enrollCustom` on the `TokenRegistry` contract. However, these methods can only be called by the owner of the contract. In other words, the `BridgeRouter` can only work if it's the owner of the `TokenRegistry` contract.
Open the reportLowContracts Might Not Be Transferred To Rightful OwnerNomad · Quantstamp · 6 Jun 2022Not fixed
Contracts inheriting from `Ownable` or `OwnableUpgradeable` will have the address that deployed the contract as the owner. If the deployment script does not change the ownership right away, the deployment address will keep ownership (along with all its privileges) instead of the rightful owner (like governance).
Open the reportLowPossible To Renounce OwnershipNomad · Quantstamp · 6 Jun 2022Not fixed
All the contracts that extend from `Ownable` or `OwnableUpgradeable` inherit a method called `renounceOwnership`. The owner of the contract can use this method to give up their ownership, thereby leaving the contract without an owner. If that were to happen, it would not be possible to perform any owner-specific functionality on that contract any more.
Open the reportIncidents1
Attached through a shared contract address. Our incident data ends in Oct 2026.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="nomad"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us