As of 3 Nov 2026, Vaulty - Goal vault and Time Vault has 2 audit reports by 1 security firm on Trustblock; the latest is by QuillAudits, dated 20 Jun 2023. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Vaulty - Goal vault and Time Vault | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| Vaulty | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 0 | 1 |
| Medium | 2 | 0 | 0 |
| Low | 6 | 0 | 4 |
Custom ERC20 tokens could be used to interact with the vault if whitelisted by the vault owner. These custom tokens could affect the internal accounting of the vault. A key example would be ‘Fee on Transfer’ tokens which can deduct a portion of tokens before or after transfers happen. The vault checks for how much was sent in the deposit() function call but not how much the contract holds and this can be problematic when fees are deducted.
Open the reportThe protocol generates revenue by collecting fees on deposits to vaults. The deposit fee can be set by the owner at any time, but if not set, depositFee will be 0. This should be a bug unless otherwise required to be a zero-fee vault at some times.
Open the reportThe codebase lacks unit test coverage. It is advisable to have test coverage greater than 95% of the codebase to reduce unexpected functionality and help fuzz test as many invariants as possible.
Open the reportIf renouncing ownership is not done appropriately, the current contract owner can renounce ownership, lose owner privileges, and lose access to the tokens sent to the contract forever. When ownership is renounced, functions like withdrawFees() will be uncallable and any fees generated from deposits will be inaccessible.
Open the reportProper code comments explain the purpose of functions in the contracts and also about the kind of parameters a function expects as an input value. This is why it is recommended that contracts should have a NATSPEC code format to give a comprehensive meaning to the functions. While there are few comments that explain the data type and few lines of the code, it is not substantial.
Open the reportState variables that are certain to be updated when called by several functions in the codebase should not be initialized and set to default values in order to save gas.
Open the reportthere are critical functions that allow for the owner to set a whitelist manager and for users to transfer their vaults but these functions fail to check that the addresses being passed as parameters is not a null address. This is also an issue with creating vaults. When users make the null address, it is impossible to claim such vaults afterwards. This is a common issue among both contracts in scope. Affected functions are as follows:• createVault/createGoal • setWhitelistManager • transferVault
Open the reportWhenever certain significant actions are performed within the contract, it is recommended to emit an event about it. Significant actions such as vault creation, setting the creation fee and updating the whitelist manager. While it is possible to track emitted events made from token contracts when depositing and withdrawing from vaults, event emissions are important to protocol to help track state changes. These functions to emit for are as follows:• createVault/createGoal • setCreationFees • setWhitelistManager
Open the reportSome of the contract functions that update the vault’s state do not emit events when called. It is advisable for ease of tracking changes on the blockchain to emit events. The following functions could have events emitted when called
Open the reportThe solidity pragma version in this codebase is unlocked.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="vaulty-goal-vault-and-time-vault"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us