Sonic Gateway security record
As of 14 Nov 2026, Sonic Gateway has 1 audit report on Trustblock, by Quantstamp, dated 17 Oct 2024. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits1
Newest first
| Report | Security firm | Date | Scope | Critical findings | Source |
|---|---|---|---|---|---|
| Sonic Gateway | Security firm: Quantstamp | Date: | Scope: Files listed | None open | certificate.quantstamp.com ↗ |
Findings9
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 1 | 2 |
| Low | 0 | 1 | 2 |
MediumFront-running Can Lead to Stolen Validator RewardsSonic Gateway · Quantstamp · 17 Oct 2024Acknowledged
The `update()` function is callable by anyone, allowing an attacker that monitors the transaction pool to submit a transaction calling the function with correct parameters and a higher gas price. As the function transfers the contract balance to the function caller, the attacker may be able to claim a reward intended for validators.
Open the reportLowMissing Support for Automatic Rebasing TokensSonic Gateway · Quantstamp · 17 Oct 2024Acknowledged
When depositing tokens on Ethereum to bridge to Sonic Network the `TokenDeposit` contract accounts for any fee-on-transfer tokens by calculating the true balance of tokens received by the contract before beginning the bridging process for a user. However, there is inadequate support for automatic rebasing tokens, such as `stETH`. Users bridging automatically rebasing tokens will eventually have their rebasing rewards stuck in the `TokenDeposit` contract.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="sonic-gateway"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us