As of 14 Oct 2026, Shiba has 2 audit reports by 2 security firms on Trustblock; the latest is by Hacken, dated 16 Jun 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| CPEG Coin / Re-Audit | Security firm: Hacken | Date: | Scope: Repository at commit f8a0a1b | No open critical findings | Open · hacken.io |
| Mars4 Shoot ERC-20 Security Review | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 5 | 0 |
As a typical ERC-20 token, the `ShootERC20` contract does not have a particular function to retrieve funds accidentally transferred to itself. As a result, these accidentally transferred funds will be locked in the contract.
Open the reportAs it is currently constructed, the `ShootERC20` contract is vulnerable to the ERC-20 allowance double-spend exploit, as are most of the known ERC-20 tokens.
Open the reportAlthough the `ShootERC20` is a typical ERC-20 token with an additional self-burning feature, it is still recommended to document the use cases of the ERC-20 token, either in the code comments or on a public-facing website. For example, document each role in the system and the expected behavior or possible actions for each role. Additionally, it is recommended that a test suite for smart contracts be developed before they are used in production. The test suite's branch coverage should be at least 90%.
Open the reportThe `ShootERC20` contract has a public `burn()` function, which allows the token holders to burn an arbitrary number of their tokens up to their entire balance. As high-level documentation or code comments for the project are not presented, the intention of such a design choice needs to be clarified. This issue is to note that users and third-party developers need to know that such a public `burn()` function exists.
Open the reportThe `ShootERC20` contract specifies in the header a version number of the format `pragma solidity ^0.8.0;` The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler may use the specified version and above, hence the term "unlocked".
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="shiba"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us