As of 3 Nov 2026, OnTact has 1 audit report on Trustblock, by CertiK, dated 3 Jan 2024. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 0 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 2 |
The `unLock()` function in the `TokenLock` contract is designed to unlock tokens based on a predefined schedule and transfer them to a specified receiver. However, the function will transfer unlocked tokens to the wallet addresses defined in `TokenLockConst.CONST_RECEIVERS[_receiverIndex]` only. The unlocked tokens could be lost if the private key of the wallet address is compromised.
Open the reportThe function `transfer()` has the restriction while the function `transferFrom()` does not, which creates an inconsistency between them. This will cause the problem that the user cannot transfer tokens to address(this) by calling `transfer()`, however, he/she can still call `transferFrom()` to transfer the tokens to address(this)`
Open the reportFollowing parts should be fixed to resolve the building failure: 1. In line 110 of `erc20/ERC20.sol`, `Address(this)` should be `address(this)` 2. In all files with such import statement: `import {IERC20} from "IERC20.sol";`, the imported path should be changed to either a relative path like `import {IERC20} from "./IERC20.sol";` or an absolute path.
Open the reportThe linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="ontact"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us