As of 25 Oct 2026, TokenOps has 1 audit report on Trustblock, by Quantstamp, dated 20 Sep 2023. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| TokenOps | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 1 | 0 |
| Low | 0 | 1 | 2 |
The current access control based on having several addresses having the role `admin` can negatively impact the system: 1. If one admin address is compromised, it can become the only admin by removing all other admins; 2. One admin address can front-run actions from another admin. For instance, it can create a grant for an address by allocating tokens deposited to the contract for another grant about to be created. 3. One admin can revoke all active grants via the function `revokeGrant()` and withdraw the unlocked tokens via the function `withdrawAdmin()`. 4. One admin can withdraw the unrelated tokens sent to the contract via the function `withdrawOtherToken()` and keep them for himself. 5. The admin could front-run other admins in case of admin access removed by others. In this case, a malicious admin could not be removed. The root cause of this issue is that each admin can trigger an action, even if it is against the interest of the system and all other admins are against this action.
Open the reportThe function `withdrawOtherToken()` can be used by an address with the role `admin` to withdraw tokens from the contract which have a different address than the vested token having the address `tokenAddress`. However, an ERC20 token can have two addresses. Tokens with this special design are called "double-entry tokens". If such type of tokens would be vested by the current contract, using the secondary address would make it possible to drain allocated tokens from the vesting contract. The severity of this issue is assessed as low, because only the admin of the contract can execute this function and double-entry tokens are an uncommon design.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="tokenops"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us