Sequence security record
As of 28 Oct 2026, Sequence has 3 audit reports by 1 security firm on Trustblock; the latest is by Quantstamp, dated 2 Dec 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Sequence - Identity Document | Security firm: Quantstamp | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · certificate.quantstamp.com |
| Sequence | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Sequence Smart Wallet | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings71
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 9 |
| Medium | 1 | 0 | 16 |
| Low | 21 | 9 | 15 |
MediumLow Number of Available TTPs Can Compromise System AvailabilitySequence - Identity Document · Quantstamp · 2 Dec 2025Open
Currently, 0xsequence operates with three TTPs (itself, and two others), requiring two to be available at any time for encryption/decryption operations to occur successfully. However, this could be a risky situation, for example, if one TTP is out of the market unexpectedly, the time to onboard a new TTP could be lengthy. In the meantime, no other TTP could become unavailable.
Open the reportLowBind HTTP Server to a Specific Network InterfaceSequence - Identity Document · Quantstamp · 2 Dec 2025Open
The HTTP server is instantiated using `http.ListenAndServe(":9999", svc)` (`/identity-instrument-master/cmd/builder-mock/main.go`, line 11\) in Go, which binds the server to all available network interfaces (`0.0.0.0`). This means the service is accessible from any network the host is connected to, including public or unintended internal networks, depending on the host's network configuration and firewall settings. This broad exposure increases the attack surface unnecessarily and may lead to unintentional service discovery, unauthorized access attempts, or abuse if firewall rules or access controls are misconfigured or absent. Binding to all interfaces is appropriate only in explicitly controlled environments (e.g., behind a reverse proxy or inside a secured container network), and even then, least-privilege design dictates narrowing exposure whenever possible.
Open the reportLowCapture and Persist Operating System Logs Past the Lifetime of a ContainerSequence - Identity Document · Quantstamp · 2 Dec 2025Open
In linux systems, important operating system logs are stored in the `/var/log` subfolder. This folder should always be made available to the host through a volume, so that log tracking and log analysis systems can capture them.
Open the reportLowConsider if Auth Key Maximum Ttl (90 Days) Is NeededSequence - Identity Document · Quantstamp · 2 Dec 2025Open
The current implementation allows authentication keys (`auth_key`) to have a maximum time-to-live (TTL) of up to 90 days. Long-lived credentials significantly increase the risk window for attackers: if the `auth_key`'s private key is leaked, phished, or otherwise compromised, it can be used for up to 90 days without requiring re-authentication. This undermines the security posture of the system, especially for sensitive operations or high-value accounts. Consider if 90 days TTL is needed; otherwise, consider lowering it to a week.
Open the reportLowDo Not Mount the Host's `docker.sock` for Any Docker ContainerSequence - Identity Document · Quantstamp · 2 Dec 2025Open
It is possible to mount the `docker.sock` interface to a container. This enables the 'Docker within Docker' scenario, but also poses a security risk, since common Docker operations on the host are then exposed to the container.
Open the reportLowDocker Compose Requires Logging Size ProtectionSequence - Identity Document · Quantstamp · 2 Dec 2025Open
Each Docker container is producing logs, which can be accessed via the command `docker logs <CONTAINER_ID>`. These logs grow over time, and it is recommended to limit the log file sizes in the Docker system and rotate them. The recommendation is to limit the number of files by 10, and let each file be at most 200MB big.
Open the reportLowDocker Containers Run Their Commands as RootSequence - Identity Document · Quantstamp · 2 Dec 2025Open
When creating a Docker container, it is possible to set the user who is actually running the application and any command on the container. It is important to specifically use the `USER` directive in any Dockerfile to ensure that the user is not root and has unnecessary privileges.
Open the reportLowDocker-Compose Should Have a Restart Policy SpecifiedSequence - Identity Document · Quantstamp · 2 Dec 2025Open
The user should always specify the way containers are supposed to behave when an error is encountered. One mechanism is by specifying the restart policy. For each container, it is best practice to specifically set the `restart` key.
Open the reportLowEmail-based OTP Lack of Limits May Lead to Spam and Potential DoS AttacksSequence - Identity Document · Quantstamp · 2 Dec 2025Open
Malicious actors may attempt to flag 0xsequence as a spammer, simply by triggering many OTP Commit-Verify requests at once. Unrestricted Commit-Verify OTP attempts may also lead to lower system throughput, potentially opening the door for Denial-of-Service attacks.
Open the reportLowEnable Bucket Logging for S3 BucketsSequence - Identity Document · Quantstamp · 2 Dec 2025Open
Logging access to any resources is a vital pillar for security. Hence, it is important that every S3 Bucket resource is set up with a proper logging configuration.
Open the reportShow 10 more
LowEnable Versioning on S3 BucketsSequence - Identity Document · Quantstamp · 2 Dec 2025Open
S3 buckets allow for versioning of the objects stored in it, and it is generally recommended to enable it since it allows access to historical versions of objects. In older versions of Terraform, this was done inline within the bucket resource definition. This inline definition is deprecated in favor of an external resource definition. This check catches the use of the deprecated method.
Open the reportLowEnsure to Have a Backup Plan for Ec2 InstancesSequence - Identity Document · Quantstamp · 2 Dec 2025Open
When using EC2 instances, it is recommended to ensure that the attached EBS volume is being backed up regularly.
Open the reportLowHave Healthcheck Parameters in DockerfilesSequence - Identity Document · Quantstamp · 2 Dec 2025Open
Dockerfiles have an instruction called `HEALTHCHECK`. It enables a user to define a command to figure out if the program(s) running inside the container are working properly. It is generally advisable to have healthchecks in place to assist monitoring of running containers.
Open the reportLowNon-Secp256k1 Signers Should Be Rejected Early OnSequence - Identity Document · Quantstamp · 2 Dec 2025Open
Non-secp256k1 signatures are not supported in the system, but are currently rejected only at the `CompleteAuth` stage.
Open the reportLowObject String Representations with Character Delimiters Need to Be ReconsideredSequence - Identity Document · Quantstamp · 2 Dec 2025Open
The codebase frequently represents complex objects or structured data as flat strings concatenated with single-character delimiters (e.g., `/`, `;`, or `:`). While this approach may seem lightweight, it introduces significant safety, parsing, and maintainability risks: - There is no inherent escaping or encoding scheme, meaning data containing the delimiter (e.g., user input) can break parsing logic or introduce ambiguity. - Any robust implementation would need to re-invent mechanisms for escaping, quoting, validation, and type coercion, which are notoriously error-prone and inconsistent. - This approach increases the likelihood of data confusion bugs, silent logic failures, and even injection vulnerabilities in downstream systems if data is passed across system boundaries (e.g., logging, storage, network calls). In some cases, the `strings.splitN` function is used, which then, in cases of the split-character appearing inside the strings itself, might cause a wrong un-marshalling. Using delimiter-based string representations over structured formats is an anti-pattern, particularly when safe, standard, and well-supported alternatives like JSON are available. Modern libraries in all languages offer mature and efficient JSON serializers/deserializers, including type safety and schema validation. The areas in the code where this occurred are: - `data/signer.go` - `encryption/kms/remote_key.go` - `encryption/pool.go` - `proto/auth_id.go` - `proto/builder/builder.gen.go` - `proto/clients/identity-instrument.gen.go` - `proto/identity.go` - `proto/identity-instrument.gen.go`
Open the reportLowOTP-Based Email Subject May Unnecessarily Expose UsersSequence - Identity Document · Quantstamp · 2 Dec 2025Open
The current email-based OTP code email is sent as part of the email subject line, which could cause the code to be leaked. Some mobile devices, for instance, may have incoming email notifications enabled. Upon displaying a notification, the setup can be configured so that the subject line of the incoming email is displayed on the notification stack. This may happen even if the mobile device is locked. While the 0xSequence team has taken the effort in using salt codes for both clients and servers, making it hard for one to authenticate when glancing over someone's mobile device, it is still a best practice to avoid OTP codes in the subject line. For example, OTP codes in subject lines may discourage users from actually opening the email, making them more prone to phishing attacks.
Open the reportLowPin Versions of Packages Installed in a Docker ImageSequence - Identity Document · Quantstamp · 2 Dec 2025Open
One desirable goal of docker images is that changing their Docker-files and re-building them in the future does not cause issues unrelated to the new changes. One way an image may not build in the future is if the Dockerfile contains instructions to install a certain program/library without pinning the version.
Open the reportLowRoot Port Usage Increases Attack SurfaceSequence - Identity Document · Quantstamp · 2 Dec 2025Open
Ports should fall within the 0-65535 range. However, both the ingress proxy and the identity instrument services do not enforce a range. The usage of non-root ports, i.e., those less than 1024, is not enforced either. This means that both binaries must be executed with root privileges, increasing the attack surface.
Open the reportLowServe OWASP Recommended Headers with Each RequestSequence - Identity Document · Quantstamp · 2 Dec 2025Open
The custom-built proxy (`/identity-instrument-master/cmd/ingress-proxy/main.go`) fails to set several critical HTTP response headers recommended by OWASP for web application security. These headers are intended to instruct browsers on how to behave when rendering content, limiting the attack surface for common exploits like XSS, clickjacking, MIME-sniffing, and resource abuse. Since this is a custom proxy implementation, these protections must be explicitly coded in, unlike in production-ready reverse proxies (e.g., NGINX or Envoy) where secure defaults or plugins are available. Without these headers, end-user browsers are left to infer behavior on their own — potentially enabling risky defaults that attackers can exploit, especially when serving dynamic or unauthenticated content.
Open the reportLowSet Limited Capabilities for Containers in Docker ComposeSequence - Identity Document · Quantstamp · 2 Dec 2025Open
Containers are spun up with operating system level capabilities, and the default set is most of the time above the needs of that specific container.
Open the reportShow 2 more
LowSet Retention Period for Cloudwatch LogsSequence - Identity Document · Quantstamp · 2 Dec 2025Open
By default, CloudWatch keeps logs indefinitely, and hence is causing potentially unnecessary storage costs.
Open the reportLowMissing Input ValidationSequence · Quantstamp · 12 Jan 2024Open
It is crucial to validate inputs, even if they come from trusted addresses, to avoid human error. A lack of robust input validation can only increase the likelihood and impact in the event of mistakes. Following is the list of places that can potentially benefit from stricter input validation: 1. qs-badge-acknowledged `ERC721Sale.sol`: the `cost` of the `setSaleDetails()` should not be zero. 2. qs-badge-fixed `ERC721Sale.sol`: the `endTime` of the `setSaleDetails()` should not be zero. 3. qs-badge-fixed `ERC721Sale.sol`: `setSaleDetails()` should validate that `startTime` is less than `endTime`. 4. qs-badge-acknowledged `ERC1155Sale.sol`: validate that `tokenIds` and `amounts` have the same length in `mint()`. 5. qs-badge-acknowledged `ERC20BaseToken.sol`: the `amount` of the `burn()` should not be zero. It is possible to burn zero amount of ERC-20 tokens with the current implementation. 6. qs-badge-acknowledged `ERC20Items.sol`: the `amount` of the `mint()` should not be zero. It is possible to mint zero ERC-20 tokens with the current implementation. 7. qs-badge-fixed `Orderbook._createOrder()` should validate that `request.tokenContract` and `request.currency` are not the zero address. 8. qs-badge-fixed `Orderbook.isOrderValidBatch()` should validate that `orderIds` and `quantities` are of equal length. 9. qs-badge-acknowledged `Trust.constructor()` should validate that `owner` and `beneficiary` are not set to the zero address.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="sequence"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us