Taiko security record
As of 25 Oct 2026, Taiko has 2 audit reports by 2 security firms on Trustblock; the latest is by OpenZeppelin, dated 26 Jun 2024. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Taiko Protocol Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 2 critical findings, fixed | Open · blog.openzeppelin.com |
| Taiko | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Findings52
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 1 | 0 | 6 |
| Medium | 0 | 1 | 8 |
| Low | 5 | 2 | 27 |
HighIncorrect Basefee Calculation on Taiko Rollups - Phase 1Taiko Protocol Audit · OpenZeppelin · 26 Jun 2024Open
The report gives no description here.
Open the reportLowSome Bridged Messages Can Not Be Refunded - Phase 2Taiko Protocol Audit · OpenZeppelin · 26 Jun 2024Open
The report gives no description here.
Open the reportLowUnexpected Features in BridgedERC20 Tokens - Phase 2Taiko Protocol Audit · OpenZeppelin · 26 Jun 2024Open
The report gives no description here.
Open the reportLowCheck __gaps have configure same size in all contractsTaiko · QuillAudits · 4 Dec 2023Open
__gap variable size is not equal to 50 in some contracts. Standard size (50) should be followed, having different sizes isn't logical it is more difficult to maintain the code.
Open the reportLowMisleading commentsTaiko · QuillAudits · 4 Dec 2023Open
In EssentialContract.sol, __Essential_init() does not take any parameters unlike __Essential_init(address _addressManager) which initializes the AddressResolver contract with an address manager. The comment is incorrect and should be updated to match the code functionality. In LibAddress.sol, the sendEther function does not check for zero-value transactions as the comment implies. This could be a to-do left unimplemented in the code. In Bridge contract on L226-227 a comment states “Use the specified message gas limit if called by the owner, else use remaining gas” but in reality the specified gas in the message should be used if not called by the owner otherwise the remaining gas should be used if the caller is the owner.
Open the reportLowReplace assert with requireTaiko · QuillAudits · 4 Dec 2023Open
_invokeMessageCall function in the contract uses assert to verify a condition, but this should not be used in deployment code as it is not a best practice to do.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="taiko-protocol"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us