Ocean Protocol security record
As of 30 Oct 2026, Ocean Protocol has 2 audit reports by 2 security firms on Trustblock; the latest is by OpenZeppelin, dated 12 Oct 2023. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Ocean Vesting Wallet Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Ocean Protocol v3 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings67
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 1 | 2 | 2 |
| Low | 0 | 30 | 31 |
MediumDust Is Paid to Last Payee in the _payees ArrayOcean Vesting Wallet Audit · OpenZeppelin · 12 Oct 2023Fixed
The report gives no description here.
Open the reportMediumInsufficient Input Validation for Vesting ScheduleOcean Vesting Wallet Audit · OpenZeppelin · 12 Oct 2023Fixed
The report gives no description here.
Open the reportLowMissing DocstringsOcean Vesting Wallet Audit · OpenZeppelin · 12 Oct 2023Fixed
The report gives no description here.
Open the reportLowActivate / Deactivate to Toggle FunctionOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The linked functions contain identical statements with the core differentiator being the boolean literal they utilize.
Open the reportLowAssembly Block DocumentationOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The purpose of the literals within the linked assembly block should be properly documented before proper evaluation of its functionality is conducted.
Open the reportLowDuplicate Mapping LookupsOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
All members of the Exchange struct are accessed and each mapping lookup operation as well as data retrieval costs significant gas.
Open the reportLowEmpty ConstructorOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
Empty constructors are redundant as they are directly implied even if not provided.
Open the reportLowEmpty ConstructorOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
Empty constructors are redundant as they are directly implied even if not provided.
Open the reportLowERC20 Specification IncompatibilityOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The ERC20 specification denotes that the decimals of a token should be of type uint8 whereas here both the getter as well as the storage variable are declared as uint256 . This will cause complete incompatibility with the ERC20 specification as external contracts will not be able to properly retrieve the decimals of the contract.
Open the reportLowInconsistent Error HandlingOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
Throughout the contracts of the project proper sanitization of input variables during construction is conducted whereby the addresses of contracts are ensured to be different than zero. However, the error message provided is of a completely different convention than DTFactory.sol for instance.
Open the reportShow 10 more
LowInefficient Greater-Than Comparisons w/ ZeroOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The linked code statements conduct a greater-than comparison between zero and an unsigned integer.
Open the reportLowInefficient Greater-Than Comparisons w/ ZeroOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The linked code statements conduct a greater-than comparison between zero and an unsigned integer.
Open the reportLowInefficient Greater-Than Comparisons w/ ZeroOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The linked code statements conduct a greater-than comparison between zero and an unsigned integer.
Open the reportLowInexistent IndexingOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The linked event declarations contain no indexed variables.
Open the reportLowLiteral AssignmentOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The _decimals variable is being assigned to the literal 18.
Open the reportLowMisleading Event Variable NamesOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The event declarations state that a timestamp type variable is emitted along the event whereas a block.number is provided instead of a block.timestamp wherever the events are emitted.
Open the reportLowPause / Unpause to Toggle FunctionOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The linked functions contain identical statements with the core differentiator being the boolean literal they utilize.
Open the reportLowPull-over-Push PatternOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
Directly replacing the minter address of a contract is dangerous as a single misinputed character can freeze the minting functions of the contract indefinitely.
Open the reportLowRedundant Event VariableOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The linked `TokenRegistered` event includes the `block.number` within the variables it emits.
Open the reportLowRedundant Event VariableOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The linked BPoolRegistered event includes the block.number within the variables it emits indexed as well.
Open the reportShow 10 more
LowRedundant Utilization of abi.encodePackedOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The abi.encodePacked function solely makes sense when the variables it operates on can be tightly packed.
Open the reportLowStruct OptimizationOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The Exchange struct can be further optimized.
Open the reportLowUnlocked Compiler VersionOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The compiler version utilized in this file uses the “^” prefix specifier, denoting that a compiler at or above the version included after the specifier should be used to compile the contracts. It is a general practise to instead lock the compiler at a specific version rather than allow a range of compiler versions to be utilized to avoid compiler-specific bugs and be able to identify ones more easily.
Open the reportLowUnlocked Compiler VersionOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The compiler version utilized in this file uses the “^” prefix specifier, denoting that a compiler at or above the version included after the specifier should be used to compile the contracts. It is a general practise to instead lock the compiler at a specific version rather than allow a range of compiler versions to be utilized to avoid compiler-specific bugs and be able to identify ones more easily.
Open the reportLowUnlocked Compiler VersionOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The compiler version utilized in this file uses the “^” prefix specifier, denoting that a compiler at or above the version included after the specifier should be used to compile the contracts. It is a general practise to instead lock the compiler at a specific version rather than allow a range of compiler versions to be utilized to avoid compiler-specific bugs and be able to identify ones more easily.
Open the reportLowUnlocked Compiler VersionOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The compiler version utilized in this file uses the “^” prefix specifier, denoting that a compiler at or above the version included after the specifier should be used to compile the contracts. It is a general practise to instead lock the compiler at a specific version rather than allow a range of compiler versions to be utilized to avoid compiler-specific bugs and be able to identify ones more easily.
Open the reportLowUnlocked Compiler VersionOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The compiler version utilized in this file uses the “^” prefix specifier, denoting that a compiler at or above the version included after the specifier should be used to compile the contracts. It is a general practise to instead lock the compiler at a specific version rather than allow a range of compiler versions to be utilized to avoid compiler-specific bugs and be able to identify ones more easily.
Open the reportLowUnlocked Compiler VersionOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The compiler version utilized in this file uses the “^” prefix specifier, denoting that a compiler at or above the version included after the specifier should be used to compile the contracts. It is a general practice to instead lock the compiler at a specific version rather than allow a range of compiler versions to be utilized to avoid compiler-specific bugs and be able to identify ones more easily.
Open the reportLowUnlocked Compiler VersionOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
TThe compiler version utilized in this file uses the “^” prefix specifier, denoting that a compiler at or above the version included after the specifier should be used to compile the contracts. It is a general practise to instead lock the compiler at a specific version rather than allow a range of compiler versions to be utilized to avoid compiler-specific bugs and be able to identify ones more easily.
Open the reportLowUnsanitized VariablesOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The input variables of the startOrder function are unsanitized, meaning that anyone is capable of setting a zero feePercentage as well as a custom feeCollector address.
Open the reportShow 3 more
LowUser Defined GettersOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
In general, it is a good practise to avoid user-defined getters and instead rely on compilergenerated ones via the public keyword as they are far more maintainable and aid in the legibility of the codebase
Open the reportLowVariable OrderingOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
Within Solidity, the order of variable declaration is important within a contract as it dictates how the compiler will tightly-pack the variables it is provided with. While the layout of the contract does not appear to follow a particular convention, it has tightly packed most slots possible except one.
Open the reportLowVisibility Specifiers MissingOcean Protocol v3 · CertiK · 8 Oct 2020Fixed
The visibility specifiers for the linked variables should be explicitly set as it is standard security practise and aids in the readability of the codebase.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="ocean-protocol"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us