As of 3 Nov 2026, Vaulty - Goal vault and Time Vault has 2 audit reports by 1 security firm on Trustblock; the latest is by QuillAudits, dated 20 Jun 2023. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Vaulty - Goal vault and Time Vault | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| Vaulty | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 0 | 1 |
| Medium | 2 | 0 | 0 |
| Low | 6 | 0 | 4 |
To be qualified to earn rewards as a user, a vault must meet some requirement they get from the portion of the reward pool. Of course, the user calling the vault of which to claim reward must be the owner, other requirements are that users must have some tokens in the vault, must not have claimed the rewards before, and that the creation time for the vault must be lesser than the timestamps allotted for the rewards. The issue arises when users call the withdraw function first before calling the claimRewards function. This is because at the point of claiming rewards, users amount will already be made to zero, denying them the right to claim rewards even though they met other requirements before calling the withdraw function.
Open the reportWith the use of modifiers on some functions restrict the privilege of who can call them. This gives us the certainty of some functions reverting when called by users not allowed to call this function, it is recommended to mark these functions as payable as this will save gas when they are called by privileged addresses.
Open the reportVaults are designed to be associated with owners and the system allows for these vaults to be transferred between different addresses. However, for vaults to be transferred, they are expected to have a non-zero balance. In the transferVault function, the check is otherwise; expecting that a vault must be zero balance before it can be transferred.
Open the reportSome ERC20 tokens are designed to revert when called transferring zero values. There are some tokens that exempt this check and when they get whitelisted, it is possible for the contract owner to call the withdrawPenaltyFee function for these tokens and this won’t revert, causing a wastage of gas after the call.
Open the reportFor gas optimization purposes, there are some unsigned comparisons made in both contracts to ensure that a function is greater than zero. This is recommended to use a check that ensures that a value is a non-zero value to save some gas rather than it being exactly greater than zero.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="vaulty-goal-vault-and-time-vault"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us