Stargaze security record
As of 21 Oct 2026, Stargaze has 4 audit reports by 2 security firms on Trustblock; the latest is by Oak Security, dated 20 Jul 2023. Those reports list 1 critical acknowledged and not fixed.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Stargaze Infinity Pool audit | Security firm: Oak Security | Date: | Scope: Not recorded (see the report) | 1 critical acknowledged, not fixed | Open · GitHub |
| Stargaze Reserve Auctions audit | Security firm: Oak Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Stargaze | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Stargaze Marketplace audit | Security firm: Oak Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings27
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 0 |
| High | 0 | 3 | 5 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 5 | 12 |
HighProtocol does not enforce minimum reserve price to be in STARS denomStargaze Reserve Auctions audit · Oak Security · 20 Jun 2023Fixed
The report gives no description here.
Open the reportHighUnhandled zero-amount transfers in marketplace contractStargaze Reserve Auctions audit · Oak Security · 20 Jun 2023Fixed
The report gives no description here.
Open the reportHighBidder can specify unchecked finders feeStargaze Marketplace audit · Oak Security · 1 Aug 2022Fixed
The report gives no description here.
Open the reportHighMisconfiguring stale bid duration causes operators to be unable to remove stale bidsStargaze Marketplace audit · Oak Security · 1 Aug 2022Fixed
The report gives no description here.
Open the reportHighpayout function may panic due to lack of fee and royalty validationStargaze Marketplace audit · Oak Security · 1 Aug 2022Fixed
The report gives no description here.
Open the reportMediumCommands not addedStargaze · CertiK · 17 Apr 2023Fixed
The `ProposalUnsetPrivilegeContractCmd` and `ProposalSetPrivilegeContractCmd` commands are currently not properly integrated into the parent command, and as a result, they may not function correctly as tx commands.
Open the reportLowIncorrect errors for InvalidTradingFeeBps and InvalidBidRemovalRewardBpsStargaze Reserve Auctions audit · Oak Security · 20 Jun 2023Fixed
The report gives no description here.
Open the reportLowMAX_FIXED_PRICE_ASK_AMOUNT is not enforced during ask price updateStargaze Reserve Auctions audit · Oak Security · 20 Jun 2023Fixed
The report gives no description here.
Open the reportLowMissing parameter validations in the reserve auction contractStargaze Reserve Auctions audit · Oak Security · 20 Jun 2023Fixed
The report gives no description here.
Open the reportLowA mismatched request structure is usedStargaze · CertiK · 17 Apr 2023Fixed
The type of `req` should be `UnsetPrivilegeProposalJSONReq`, the below code segment uses a mismatched request. ````go=28 func ProposalDemotePrivilegeContractHandler(cliCtx client.Context) govrest.ProposalRESTHandler { return govrest.ProposalRESTHandler{ SubRoute: "wasm_demote_privilege", Handler: func(w http.ResponseWriter, r *http.Request) { var req SetPrivilegeProposalJSONReq if !rest.ReadRESTReq(w, r, cliCtx.LegacyAmino, &req) { return } toStdTxResponse(cliCtx, w, req) }, } } ````
Open the reportShow 8 more
LowFailure on Tx cmdStargaze · CertiK · 17 Apr 2023Fixed
The [`readme`](https://github.com/public-awesome/stargaze/tree/b31a13e81a927d11449d2e9a176cd9d5a914039d/x/cron#how-to-use-in-cw-contract) for the current module provides some helpful `tx` command examples, but it has been found that some of them may not function as expected. For instance, the `promote-contract` command example is shown below: ````cmd starsd tx cron promote-contract {contractAddr} --title {proposalTitle} --deposit {depositAmount} starsd tx cron promote-contract stars19jq6mj84cnt9p7sagjxqf8hxtczwc8wlpuwe4sh62w45aheseues57n420 --title "Promote Contract Proposal" --deposit 1000ustars ```` When executing this command directly, it generates an error message indicating an invalid address. Upon further investigation, it has been determined that this error is due to the lack of a proposer, i.e., it cannot obtain the `from` address of the `clientCtx`. Additionally, the `from` flag for this command is not recognized.
Open the reportLowIncorrect Key UsedStargaze · CertiK · 17 Apr 2023Fixed
In Cosmos, the `telemetry.ModuleMeasureSince` function is used to measure the elapsed time since a specific event occurred in a module. When using this function in the `BeginBlocker()` function of a Cosmos SDK module, it is important to use the correct metric key for the event being measured. ````go func BeginBlocker(ctx sdk.Context, k keeper.Keeper, w types.WasmKeeper) { defer telemetry.ModuleMeasureSince(types.ModuleName, time.Now(), telemetry.MetricKeyEndBlocker) sudoMsg := contract.SudoMsg{BeginBlock: &struct{}{}} k.IteratePrivileged(ctx, abciContractCallback(ctx, w, sudoMsg)) } ```` The correct metric key for measuring the elapsed time of the `BeginBlocker()` function is `telemetry.MetricKeyBeginBlocker`.
Open the reportLowOptimization on function `SetPrivileged()`Stargaze · CertiK · 17 Apr 2023Fixed
The `SetPrivileged()` function is used to add a contract to the list of privileged contracts or update it if it is already in the list. However, if the contract is already privileged, there is no need to update the store and this can be an unnecessary gas cost.
Open the reportLowBidders may set themselves as finder and receive finders feeStargaze Marketplace audit · Oak Security · 1 Aug 2022Fixed
The report gives no description here.
Open the reportLowExisting operators will be overwrittenStargaze Marketplace audit · Oak Security · 1 Aug 2022Fixed
The report gives no description here.
Open the reportLowPercentage and basis point values lack maximum value validationStargaze Marketplace audit · Oak Security · 1 Aug 2022Fixed
The report gives no description here.
Open the reportLowRelease candidate dependenciesStargaze Marketplace audit · Oak Security · 1 Aug 2022Fixed
The report gives no description here.
Open the reportLowSellers can update the price for inactive ask requestsStargaze Marketplace audit · Oak Security · 1 Aug 2022Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="stargaze"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us