Teku security record
As of 3 Nov 2026, Teku has 1 audit report on Trustblock, by Quantstamp, dated 29 Sep 2020. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Teku | Security firm: Quantstamp | Date: | Scope: Repository at commit 1069ade | No open critical findings | Open · certificate.quantstamp.com |
Findings29
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 1 | 2 | 5 |
| Low | 0 | 6 | 14 |
MediumCritical Component Dependent on Unaudited External LibraryTeku · Quantstamp · 29 Sep 2020Acknowledged
The `bls` module has two implementations of BLS. One of them is based on the unaudited `blst` library: supranational/blst: BLS12-381 signature library (https://github.com/supranational/blst). This might introduce additional attack vectors.
Open the reportMediumOpen Admin EndpointTeku · Quantstamp · 29 Sep 2020Acknowledged
This is an admin endpoint, but it does not seem to be authenticated in any way. As it stands, it appears that an unauthorized party would be able to change the logging configuration for the application. While changing the logging level does not seem to expose any sensitive information, it is an undesirable action that should be reserved only to authorized admins.
Open the reportLowBeta ImportsTeku · Quantstamp · 29 Sep 2020Acknowledged
In `BeaconRestApi`, `import 'com.google.common.io.Resources'` is marked unstable with `@Beta`.
Open the reportLowMulticast DNS is a clone from JMDNSTeku · Quantstamp · 29 Sep 2020Acknowledged
Class: io.libp2p.discovery.mdns.* The minimal multicast DNS implementation is a clone of certain parts of the JMDNS library (see [https://github.com/jmdns/jmdns](https://github.com/jmdns/jmdns)), without any reference to what commit head was used. As a negative side-effect, any updates or vulnerability fixes in the upstream repository must be manually tracked, pulled, and merged by Teku developers, which if not done regularly, could lead to bugs or security issues being left unfixed.
Open the reportLowNo Call Rate LimitingTeku · Quantstamp · 29 Sep 2020Acknowledged
There is no rate limiting on the API/RPC calls. While this may be intentional, excessive calls may result in poor or denied service.
Open the reportLowNon-Deterministic Filter Leads to Non-Deterministic BehaviourTeku · Quantstamp · 29 Sep 2020Acknowledged
On line 25 and 26, `Remote_fault` and `Remote_unresponsive` share the same `enum` number. Therefore, `fromReasonCode` will have `.filter` provide a stream of `REMOTE_FAULT` and `UNRESPONSIVE`, and `findAny` will non-deterministically provide out `REMOTE_FAULT` or `UNRESPONSIVE `for code `3`.
Open the reportLowPossible Loss of PrecisionTeku · Quantstamp · 29 Sep 2020Acknowledged
In lines 169 and 170 the function `getDepositsWithProof()` casts `long`s to `int`s. For a number of deposits large enough this may result in a loss of precision.
Open the reportLowUsers Behind a NAT Must Configure Their Inbound Traffic SetupTeku · Quantstamp · 29 Sep 2020Acknowledged
According to the Eth2 p2p spec: “Nodes operating behind a NAT, or otherwise undialable by default (e.g. container runtime, firewall, etc.), MUST have their infrastructure configured to enable inbound traffic on the announced public listening endpoint” This issue is not supposed to be handled by the existing code, but rather by instructing node operators on how to configure their deployment. In the given repository, we did not find any information related to the given matter. If users are unaware of this issue, the node will not receive any inbound traffic on its announced public endpoint.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="teku"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us