StackUp security record

As of 21 Oct 2026, StackUp has 2 audit reports by 2 security firms on Trustblock; the latest is by Cantina, dated 18 Aug 2025. Those reports list 2 open critical findings. It also holds 1 deployed contract on 1 chain.

Critical findings
2 open critical findings
Reported in “StackUp” by Cyberscope, Jun 2022. Not marked fixed in that report. See the findings
Open the latest report
Your label, live
Get the label for your site

Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.

Audits2

Newest first

AuditSecurity firmDateScopeCritical findingsReport
Stackup KeystoreSecurity firm: CantinaDate: Scope: Not recorded (see the report)No open critical findingsOpen · cantina.xyz
StackUpSecurity firm: CyberscopeDate: Scope: 1 address on BNB Chain2 open critical findingsOpen · IPFS

Findings21

Statuses are the security firm’s own, from each report.

SeverityOpenAcknowledgedFixed
Critical200
High000
Medium203
Low716

Marked Gas Optimization or Informational by the firms. Not counted as findings.

Gas OptimizationCache read directly after writeStackup Keystore · Cantina · 18 Aug 2025Acknowledged

The report gives no description here.

Open the report
InformationalDifferent proof type used in registerNode()Stackup Keystore · Cantina · 18 Aug 2025Acknowledged

The report gives no description here.

Open the report
InformationalMissing short-circuit in dual signature verificationStackup Keystore · Cantina · 18 Aug 2025Acknowledged

The report gives no description here.

Open the report
InformationalPossible reverts in loop of handleUpdates()Stackup Keystore · Cantina · 18 Aug 2025Acknowledged

The report gives no description here.

Open the report
Informationalsd.index could be too largeStackup Keystore · Cantina · 18 Aug 2025Acknowledged

The report gives no description here.

Open the report
InformationalUnnecessary signature validations when signature count is below thresholdStackup Keystore · Cantina · 18 Aug 2025Acknowledged

The report gives no description here.

Open the report
Gas OptimizationValue could already be in the cacheStackup Keystore · Cantina · 18 Aug 2025Acknowledged

The report gives no description here.

Open the report
Informational20 could be a constantStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalAdding new verifiers has to be controlledStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
Gas OptimizationArray lenght in for loop is inefficientStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
Show 10 more
InformationalBad actor could hide a malicious configuration in the Merkle treeStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalCache mechanism not documented in specificationStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalConversion to bytes not obviousStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalDifference between spec and codeStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalFunction getRegisteredNode() could be simplifiedStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalFunction name of _validateNode doesnt cover its functionalityStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalNative Solidity slicing can be usedStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalNFTs can't be stored in KeystoreAccountStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalPermanent stake and configuration of timeStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalPublic variable starts with _Stackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
Show 10 more
InformationalrefHash might not be uniqueStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalReplayability as default should be explicitly documentedStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalSmart account implementations must implement signature replay protectionStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalString based errorStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalUnderspecified data parameter in verifier contractsStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalUnnecessary elseStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalUse named parameters for nested mappingsStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
Gas OptimizationverifyCalldata() can be usedStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalWebAuthn verifiers implicitly assume deployment of P256 signature validators in current chainStackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report
InformationalWhat if a roothash update fails on one of the chains?Stackup Keystore · Cantina · 18 Aug 2025Fixed

The report gives no description here.

Open the report

Contracts1

AddressChainSource code
0xbf085b601a4b4d7104ae1d4abdd07099e72c3460Chain: BNB ChainSource code: Verified source

Show this on your site

Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.

Content

Facts

Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.

Fixed as
Language

Style

Layout
Theme
Accent
Corners

Format

Size
Date
Embed as
HTML
<head>
<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
</head>
<body>
<div
data-tb-project-widget
data-tb-project-slug="stackup"
></div>
</body>

Paste the code where the label should appear. It uses no API credit and updates by itself.

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us