As of 3 Nov 2026, OMG Network has 2 audit reports by 2 security firms on Trustblock; the latest is by Consensys, dated 1 Jan 2020. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| OmiseGo MoreVP | Security firm: Consensys | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · diligence.security |
| Omisego Plasma MVP | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 1 | 0 | 3 |
| Medium | 1 | 0 | 2 |
| Low | 17 | 0 | 8 |
The report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe contract RootChain.sol uses the constant CHILD_BLOCK_INTERVAL to distinguish between child chain and deposit blocks. It protects against reorgs, i.e., block and transaction order changing on the root chain. Reorgs can lead to spurious invalidity of the child chain. The check in line 161, however, can be bypassed and, consequently, the invariant that deposit blocks should never appear in child block indices and vice-versa can be violated. We note that the issue may be exploited by a malicious token contract which can be added by any user. Exploit Scenario: 1. Add malicious token contract to RootChain.sol via the function addToken(). 2. depositFrom() calls transferFrom() (line 164). 3. transferFrom() of a malicious token calls deposit() multiple times till currentDepositBlock == CHILD_BLOCK_INTERVAL - 1. 4. transferFrom() returns true allowing writeDepositBlock() to increment currentDepositBlock beyond CHILD_BLOCK_INTERVAL. 5. This allows a malicious token to enable transfers without a real deposit as the deposit block will be overwritten by the next submitted plasma block.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe function depositFrom() takes owner as parameter instead of relying on msg.sender. Consequently, once an allowance is approved, anybody may initiate a deposit on behalf of the owner at any time, even against the actual owner's will.
Open the reportTrufe is a prominent tool used for organizing Solidity code projects. It helps to manage dependencies, run tests, and process the code with other tools.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="omg-network"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us