Tokemak security record
As of 21 Oct 2026, Tokemak has 6 audit reports by 2 security firms on Trustblock; the latest is by Hexens, dated 25 Mar 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits6
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Tokemak security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Tokemak security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Tokemak Acctoke Migration security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Tokemak Mainnet Follow Up security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Tokemak security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Tokemak | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings60
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 1 | 9 |
| Medium | 0 | 2 | 15 |
| Low | 1 | 9 | 21 |
Marked Informational by the firms. Not counted as findings.
InformationalInconsistent pausing logicTokemak Acctoke Migration security review · Hexens · 7 Oct 2024Acknowledged
The report gives no description here.
Open the reportInformationalInsufficient migrationAmount check to be Staked in v2Tokemak Acctoke Migration security review · Hexens · 7 Oct 2024Acknowledged
The report gives no description here.
Open the reportInformationalSingle-step ownership change introduces risksTokemak Acctoke Migration security review · Hexens · 7 Oct 2024Acknowledged
The report gives no description here.
Open the reportInformationalUse custom errorsTokemak Acctoke Migration security review · Hexens · 7 Oct 2024Acknowledged
The report gives no description here.
Open the reportInformationalInconsistent script naming conventionsTokemak Mainnet Follow Up security review · Hexens · 20 Aug 2024Acknowledged
The report gives no description here.
Open the reportInformationalConstant variables should be marked as privateTokemak security review · Hexens · 22 Jul 2024Acknowledged
The report gives no description here.
Open the reportInformationalInconsistent usage of constant values and literalsTokemak security review · Hexens · 22 Jul 2024Acknowledged
The report gives no description here.
Open the reportInformationalStaked Toke will still earn rewards after lockup has expiredTokemak security review · Hexens · 22 Jul 2024Acknowledged
The report gives no description here.
Open the reportInformationalUse of external calls to the same contractTokemak security review · Hexens · 22 Jul 2024Acknowledged
The report gives no description here.
Open the reportInformationalLstPriceHook tolerance is not capped to a maximumTokemak security review · Hexens · 25 Mar 2025Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalNo access control in withdrawBaseAsset functionTokemak security review · Hexens · 25 Mar 2025Fixed
The report gives no description here.
Open the reportInformationalSimplification of hook unregistration using deleteTokemak security review · Hexens · 25 Mar 2025Fixed
The report gives no description here.
Open the reportInformationalUsage of literals instead of named constantsTokemak security review · Hexens · 25 Mar 2025Fixed
The report gives no description here.
Open the reportInformationalExploitable rounding error in token swapsTokemak security review · Hexens · 26 Dec 2024Fixed
The report gives no description here.
Open the reportInformationalPublic constants should be marked as privateTokemak security review · Hexens · 26 Dec 2024Fixed
The report gives no description here.
Open the reportInformationalDefault value initializationTokemak Acctoke Migration security review · Hexens · 7 Oct 2024Fixed
The report gives no description here.
Open the reportInformationalRedundant castingTokemak Acctoke Migration security review · Hexens · 7 Oct 2024Fixed
The report gives no description here.
Open the reportInformationalUse unchecked when it is safeTokemak Acctoke Migration security review · Hexens · 7 Oct 2024Fixed
The report gives no description here.
Open the reportInformationalOptimization of zero TVL check in calculateEthPerToken functionTokemak Mainnet Follow Up security review · Hexens · 20 Aug 2024Fixed
The report gives no description here.
Open the reportInformationalInitial total assets high mark missing timestamp and eventTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportShow 3 more
InformationalMissing events on configuration changesTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportInformationalThe snapshot for the extra rewarder can be taken without permissionTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportInformationalWithdrawn lock ups can still be extendedTokemak security review · Hexens · 22 Jul 2024Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="tokemak"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us