The Graph security record
As of 3 Nov 2026, The Graph has 7 audit reports by 1 security firm on Trustblock; the latest is by OpenZeppelin, dated 20 Sep 2023. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits7
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| The Graph Timeline Aggregation Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| The Graph | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| The Graph | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| The Graph | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| The Graph | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| The Graph | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| The Graph RewardsManager Upgrade Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
Findings22
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 0 |
| Medium | 1 | 1 | 5 |
| Low | 2 | 0 | 12 |
CriticalFront-Running redeem Can Prevent Indexers From Receiving Rewards for AllocationsThe Graph Timeline Aggregation Audit · OpenZeppelin · 20 Sep 2023Fixed
The report gives no description here.
Open the reportMediumSigned Messages Can Be ReplayedThe Graph Timeline Aggregation Audit · OpenZeppelin · 20 Sep 2023Fixed
The report gives no description here.
Open the reportMediumVesting Contracts Cannot Call redeemThe Graph Timeline Aggregation Audit · OpenZeppelin · 20 Sep 2023Fixed
The report gives no description here.
Open the reportMedium[M01] Old contract versions can be mistakenly usedThe Graph · OpenZeppelin · 27 Apr 2021Fixed
The report gives no description here.
Open the reportMedium[M01] Lack of event emission after sensitive actionThe Graph · OpenZeppelin · 27 Apr 2021Fixed
The report gives no description here.
Open the reportMedium[M02] Proposal’s update can assume prior statesThe Graph · OpenZeppelin · 27 Apr 2021Fixed
The report gives no description here.
Open the reportLowpush0 OPCODE Incompatible With ArbitrumThe Graph Timeline Aggregation Audit · OpenZeppelin · 20 Sep 2023Fixed
The report gives no description here.
Open the reportLowRetrieving Escrow Account Details via Signers Can Be MisleadingThe Graph Timeline Aggregation Audit · OpenZeppelin · 20 Sep 2023Fixed
The report gives no description here.
Open the reportLowUnnecessary Event EmissionThe Graph Timeline Aggregation Audit · OpenZeppelin · 20 Sep 2023Fixed
The report gives no description here.
Open the reportLow[L01] Duplicated codeThe Graph · OpenZeppelin · 27 Apr 2021Fixed
The report gives no description here.
Open the reportShow 8 more
Low[L02] Constant is not declared explicitlyThe Graph · OpenZeppelin · 27 Apr 2021Fixed
The report gives no description here.
Open the reportLow[L03] Same event used for multiple variablesThe Graph · OpenZeppelin · 27 Apr 2021Fixed
The report gives no description here.
Open the reportLow[L04] Unclear lack of input validationThe Graph · OpenZeppelin · 27 Apr 2021Fixed
The report gives no description here.
Open the reportLow[L01] Lack of input validationThe Graph · OpenZeppelin · 27 Apr 2021Fixed
The report gives no description here.
Open the reportLow[L02] Unclean codeThe Graph · OpenZeppelin · 27 Apr 2021Fixed
The report gives no description here.
Open the reportLow[L01] Duplicated gettersThe Graph · OpenZeppelin · 27 Apr 2021Fixed
The report gives no description here.
Open the reportLow[L01] Lack of input validationThe Graph · OpenZeppelin · 27 Apr 2021Fixed
The report gives no description here.
Open the reportLow[L02] Lack of docstringsThe Graph · OpenZeppelin · 27 Apr 2021Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="the-graph"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us