As of 3 Nov 2026, Realto has 2 audit reports by 2 security firms on Trustblock; the latest is by CertiK, dated 10 Oct 2022. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Realtoapps Smart Contract Audit | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| RealTo Apps | Security firm: SolidProof | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · IPFS |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 8 | 0 | 0 |
| Medium | 0 | 0 | 7 |
| Low | 2 | 0 | 6 |
The function `require` needs to check that the number of unlocked tokens of `_from` is not less than the number of transfers, not the number of `msg.sender`.
Open the reportFor upgradeable contracts, there must be storage gap to "allow developers to freely add new state variables in the future without compromising the storage compatibility with existing deployments". Otherwise it may be very difficult to write new implementation code. Without storage gap, the variable in child contract might be overwritten by the upgraded base contract if new variables are added to the base contract. Refer to https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable We noticed that there are several contracts that inherits upgradable contracts, but do not have storage gap.
Open the reportThe hacker can perform a potential arbitrage with the function `dividendsOwing()`. Example. 1) If A has 100 tokens, and A transfers 100 tokens to B, A can call `withdrawDividendOnchain()` to claim the dividend. 2) B transfers 100 tokens to C, and B can also claim dividend. ... So all the dividends in the contract will be taken by the hacker.
Open the reportThe function `freezeTokens()` is called by `DEFAULT_ADMIN_ROLE` to freeze the user's tokens. If the user already has some tokens frozen, then the verification of function `require` will not be appropriate.
Open the report1, The function `transferFrom()` in contract `BaseERC20` is invoked to transfer tokens and is not charged, but the function `transfer()` is charged, so the user can avoid the charge by calling the `transferFrom()`. 2, The function `buy()` in contract `CrowdSales` is called to buy tokens using eth and check that whether the user is locked, but the `buyWithStablecoin()` does not check.
Open the report1, Lines 102 and 104 of the code in contract `BaseERC20` should use `_msgSender` instead of `msg.sender`. 2, 115 lines of code for contract `BaseERC20`, the modifier `adminOrMsgSender` parameter should use `_msgSender` instead of `_address`. 3, Is it possible to replace `msg.sender` and `msg.value` with `_msgSender()` and `_msgData()` in the `buy()` function of the contract `CrowdSales`?
Open the reportThe function `transferFrom()` is called to transfer the tokens from `_from` to `_to`, but does not check if the address `_from` and `_msgSender()` are locked, and the `forceTransfer()` function has the same issue.
Open the reportThere are hardcode addresses in this codebase.
Open the reportThe function `_freezeTokens()` is invoked to freeze the user's tokens, but does not check if the `_lockId` already exists, if it exists, then the data will be overwritten and the frozen tokens will not be unlocked.
Open the reportIt's recommended the team verify the UUPS implementation contract is initialized correctly. Besides initializing the contract, another way to prevent the implementation contract from being used is to invoke the "_disableInitializers" function in the constructor to automatically lock it when it is deployed. For more information, please refer to: https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable#initializing_the_implementation_contract
Open the reportThe value of the `currentDividned` is declared as `uint256`, so the variable `currentDividned` is always greater than or equal to `0`. Also, it seems the variable name should be `currentDividend` instead of `currentDividned`
Open the reportThe contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.
Open the report1, The contract `Ownable` is imported, but no functions from `Ownable` are used. 2, The internal functions `_msgSender()` and `_msgData()` are declared, but not used. 3, The modifier `canTransfer` is declared, but not used. 4, The value of the `lockTokens` is defined as `uint256`, so the variable `lockTokens[_address]` is always no less than `amount`, which defaults to 0.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="realto"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us