Sablier security record
As of 3 Nov 2026, Sablier has 2 audit reports by 2 security firms on Trustblock; the latest is by Cyfrin, dated 25 Mar 2026. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Sablier Bob / Escrow Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Sablier | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings17
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 1 |
| Medium | 0 | 1 | 3 |
| Low | 0 | 6 | 5 |
Marked Informational or Gas by the firms. Not counted as findings.
InformationalAdd validation in SablierBob::createOrder to disallow same address as buyer and sellerSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Acknowledged
The report gives no description here.
Open the reportInformationalAttacker can permanently lock or drain fee-on-transfer tokens from SablierEscrowSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Acknowledged
The report gives no description here.
Open the reportInformationalConsider adding a vault migration feature so non-adapter vault users can migrate to a vault with an adapterSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Acknowledged
The report gives no description here.
Open the reportGasEmit event first to optimize away previous value variablesSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Acknowledged
The report gives no description here.
Open the reportInformationalIn Solidity don’t initialize to default valuesSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Acknowledged
The report gives no description here.
Open the reportInformationalMissing or inadequate Chainlink Oracle checks in SablierBob.solSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Acknowledged
The report gives no description here.
Open the reportInformationalUse read-then-increment in one lineSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Acknowledged
The report gives no description here.
Open the reportGasUse ReentrancyGuardTransient for faster nonReentrant modifiersSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Acknowledged
The report gives no description here.
Open the reportGasUse SafeTransferLib::safeTransferETH instead of Solidity call to send ETH in SablierBob::redeemSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Acknowledged
The report gives no description here.
Open the reportGasCache storage to prevent identical storage readsSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Fixed
The report gives no description here.
Open the reportShow 10 more
GasDon’t copy entire struct from storage to memory when only few fields requiredSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Fixed
The report gives no description here.
Open the reportInformationalEmit event SyncPriceFromOracle when price is syncedSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Fixed
The report gives no description here.
Open the reportInformationalMissing getter function for SablierBobState::isStakedInAdapterSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Fixed
The report gives no description here.
Open the reportGasQA/Gas improvements in related Sablier contractsSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Fixed
The report gives no description here.
Open the reportInformationalRemove or resolve TODOSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Fixed
The report gives no description here.
Open the reportGasRevert fast by performing input related checks prior to storage reads and external callsSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Fixed
The report gives no description here.
Open the reportGasSablierBob::_unstakeFullAmountViaAdapter should take vault.adapter as input parameterSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Fixed
The report gives no description here.
Open the reportGasSablierLidoAdapter::unstakeFullAmount should return totalWstETHSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Fixed
The report gives no description here.
Open the reportGasUse msg.sender instead of accessing comptroller state variable to save gasSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Fixed
The report gives no description here.
Open the reportGasUse named return variables where this can optimize away local variablesSablier Bob / Escrow Audit Report · Cyfrin · 25 Mar 2026Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="sablier"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us