Persistence security record
As of 21 Oct 2026, Persistence has 4 audit reports by 2 security firms on Trustblock; the latest is by Hexens, dated 12 Apr 2024. Those reports list 2 criticals acknowledged and not fixed.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Persistence Stkbnb security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| pSTAKE Native Auto-Compounding and Rebalancing aud | Security firm: Oak Security | Date: | Scope: Not recorded (see the report) | 1 critical acknowledged, not fixed | Open · GitHub |
| Persistence security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Persistence Bridge - audit | Security firm: Oak Security | Date: | Scope: Not recorded (see the report) | 1 critical acknowledged, not fixed | Open · GitHub |
Findings62
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 2 | 11 |
| High | 0 | 3 | 15 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 5 | 23 |
CriticalIncorrectly using the shares of the destination validator as the input for the _STAKE_HUB.redelegate() functionPersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportCriticalAttackers can halt the chain by performing numerous minimal unstaking requests from different accountspSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportCriticalAttackers can prevent users from liquid-staking funds by removing the Deposit entrypSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportCriticalIncorrect bookkeeping of validator’s delegated amount upon redelegationpSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportCriticalRisk of gas exhaustion for unbounded ICA messagespSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportCriticalUSER CAN LOCK AND STAKE ARBITRARY AMOUNT OF TOKENS WITHOUT PAYINGPersistence security review · Hexens · 12 Jan 2024Fixed
The report gives no description here.
Open the reportCriticalBadgerDB and Ka a operations do not happen atomically, potentially leading inconsistent state and missed bridged transactionsPersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportCriticalLack of Ka a message deduplication can lead to accidental transaction replayPersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportCriticalMnemonic/seed phrase as well as a bearer token exists in the codebasePersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportCriticalTLS connection to CASP is prone to man-in-the-middle attacksPersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportShow 10 more
CriticalUnbonding of all funds will failPersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportHighBroken validator creation logicPersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportHighIncorrect usage of shares instead of stakes occurs when calling the ValidatorSet._redelegate functionPersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportHighIncorrect value of exchangeRate.totalWei due to redelegation feesPersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportHighIndex out of bounds error in function StakePool._getDailyReward()Persistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportHighThe StakePool.initiateRedelegation() function does not factor in the redelegation feePersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportHighThe totalWei is inflated due to the presence of duplicated validator addressesPersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportHighUtilization of outdated validator stakes during redelegationPersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportHighIncorrect comparison between shares and tokenspSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportHighThe DoRedeemLSMTokens function consumes excessive computational resources in the BeginBlockerpSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportShow 10 more
HighThe rewards account balance is not updated on OnChanOpenAckpSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportHighValidators are incorrectly set to non-delegable for default bond factor valuespSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportHighDIVISION BY ZERO IN SHARE CONVERSION LEADS TO PANIC AND DENIAL-OF-SERVICEPersistence security review · Hexens · 12 Jan 2024Fixed
The report gives no description here.
Open the reportHighCASP API token can be read by any user on the machinePersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportHighSigning may failPersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportHighTransaction page calculation using floating point numbers could be off by one, causing transactions to be missedPersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportMediumUnable to execute StakePool.epochUpdate() because of the mismatch between shares and stakes of a validatorPersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportMediumUnable to initiate unbonding due to an underflow error with the weightage variablePersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportMediumUNBONDING OF VALIDATORS DOES NOT GIVE PRIORITY TO INACTIVE VALIDATORSPersistence security review · Hexens · 12 Jan 2024Fixed
The report gives no description here.
Open the reportLowDeposits can temporarily stuck in DelegationManager contractPersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowFunction _isActiveValidator() does not check the state of StakeHub contractPersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportLowLack of testsPersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportLowSelfdestruct is deprecated after the Kepler hardforkPersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportLowUnnecessary if statement in the DelegationManager.delegateDep ositedBNB() functionPersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportLowValidator status is not checked in the initiateDelegation() functionPersistence Stkbnb security review · Hexens · 12 Apr 2024Fixed
The report gives no description here.
Open the reportLowA significant decrease in CValue could disable the host chain and require a global parameters updatepSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportLowFees lack validationpSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportLowHost denom can be registered with multiple host chainspSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportLowIncomplete HostChain validationpSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportLowLowerCValueLimit can be misconfigured as a negative valuepSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowThe bond factor is not set to the default value when registering host chainspSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportLowThe RegisterHostChain function allows topSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportLowUnhandled errors in the codebasepSTAKE Native Auto-Compounding and Rebalancing aud · Oak Security · 26 Jan 2024Fixed
The report gives no description here.
Open the reportLowWHITELISTED VALIDATOR TARGET WEIGHT IS UNCAPPED AND UNITLESSPersistence security review · Hexens · 12 Jan 2024Fixed
The report gives no description here.
Open the reportLowWHITELISTED VALIDATORS CANNOT BE INACTIVATEDPersistence security review · Hexens · 12 Jan 2024Fixed
The report gives no description here.
Open the reportLowErroneous batch size counting logic will lead to bigger batch sizes than setPersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportLowUnchecked error during initialization and start of chainPersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportLowUsage of leaking time. Tick will lead the program to run out of memoryPersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportLowUsage of loops for retrying without timeouts may lead to program running out of memory or deadlock on shutdownPersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportLowUsage of magic numbers throughout the codebasePersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportShow 2 more
LowWhen no validator is in database the program does not panicPersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportLowWrong validation before setting Ethereum public key in configurationPersistence Bridge - audit · Oak Security · 20 Jan 2022Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="persistence-one"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us