VeChain security record
As of 21 Oct 2026, VeChain has 6 audit reports by 3 security firms on Trustblock; the latest is by Hacken, dated 4 Feb 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits6
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| VeChain / Stargate | Security firm: Hacken | Date: | Scope: Files named in the report | 2 critical findings, fixed | Open · hacken.io |
| VeChain / Stargate | Security firm: Hacken | Date: | Scope: Files named in the report | No open critical findings | Open · hacken.io |
| Vechain SDK | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · skynet.certik.com |
| VeChain / BaseMarketplace | Security firm: Hacken | Date: | Scope: Files named in the report | No open critical findings | Open · hacken.io |
| Vechain Foundation / Marketplace | Security firm: Hacken | Date: | Scope: Files named in the report | No open critical findings | Open · audits.hacken.io |
| VeChain: VVET audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings81
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 7 |
| Medium | 1 | 0 | 10 |
| Low | 9 | 6 | 46 |
Critical[DualDefense] Exited Delegator Receives RewardsVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportCriticalRewards Drain due to Invalid Last Claimed Period UpdateVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportHigh[DualDefense] Double Effective Stake Reduction on Redelegation Leading to Arithmetic UnderflowVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportHighMissing Effective Stake Decrease During UnstakeVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportHighPermanent Phantom Stake Accumulation Due to Missing Effective Stake Cleanup on Re-delegationVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportHighClaim Process DoS due to Reentrancy ProtectionVeChain / Stargate · Hacken · 30 Jun 2025Fixed
The report gives no description here.
Open the reportHighImpossible to Create Listings with the Same tokenID for Different NFTsVeChain / BaseMarketplace · Hacken · 26 Jul 2024Fixed
The report gives no description here.
Open the reportHighDenial of Service - Broken Functionality of the AuctionVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportHighRequirements Violation, Admin Cannot Cancel Users’ AuctionsVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportMediumERC-7201 Storage Location Comment Does Not Match Actual ValueVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportShow 10 more
MediumOff-By-One Error in `_exceedsMaxClaimablePeriods()` Allows Claiming One Extra Period Beyond Configured MaximumVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportMediumStorage Inconsistency in `migrateTokenManager` Function Leading to Data CorruptionVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportMediumUnauthorized Delegation via `migrateAndDelegate()` FunctionVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportMediumDelegation on Behalf of Another User due to Ownership Check BypassVeChain / Stargate · Hacken · 30 Jun 2025Fixed
The report gives no description here.
Open the reportMediumEstimated VTHO Reward Stop Timestamp May Miss Actual VeChain Network Fork TimeVeChain / Stargate · Hacken · 30 Jun 2025Fixed
The report gives no description here.
Open the reportMediumIncorrect Value is Passed to the PrototypeVeChain / BaseMarketplace · Hacken · 26 Jul 2024Fixed
The report gives no description here.
Open the reportMediumOutdated Price Usage due to Lack of Price Oracle ConsistencyVeChain / BaseMarketplace · Hacken · 26 Jul 2024Fixed
The report gives no description here.
Open the reportMediumpurchaseMany() Function Requires Users to Provide the VET in an Amount Equal to the Sale PriceVeChain / BaseMarketplace · Hacken · 26 Jul 2024Fixed
The report gives no description here.
Open the reportMediumRedundant receive() functionalityVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowDefault Admin Managing PausabilityVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportShow 10 more
LowHardcoded Magic ValueVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportLowInconsistent Comparison PatternVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportLowIncorrect legacyLastTokenId Can Cause Permanent Token ID CollisionsVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportLowInefficient Implementation in `hasRequestedExit()` FunctionVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportLowMissing Code-Level Enforcement of X Token Minting RestrictionVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportLowMissing Level Existence Checks in Internal Helper FunctionsVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportLowPotential Precision Loss on Reward ClaimVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportLowReentrancyGuard Not Explicitly Initialized in Stargate ContractVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportLowUnused Custom Error Definitions in Error LibraryVeChain / Stargate · Hacken · 4 Feb 2026Fixed
The report gives no description here.
Open the reportLowInconsistent and Always-True Boolean Return PatternVeChain / Stargate · Hacken · 30 Jun 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowLack of ERC20 Operation Success ValidationVeChain / Stargate · Hacken · 30 Jun 2025Fixed
The report gives no description here.
Open the reportLowLack of Upgradeable Contracts InitializationVeChain / Stargate · Hacken · 30 Jun 2025Fixed
The report gives no description here.
Open the reportLowPossible disabling the `isActive` flag for migrate tiers may cause false expectationsVeChain / Stargate · Hacken · 30 Jun 2025Fixed
The report gives no description here.
Open the reportLowRevert Messages OptimizationVeChain / Stargate · Hacken · 30 Jun 2025Fixed
The report gives no description here.
Open the reportLowToken URI ERC-721 Metadata IncomplianceVeChain / Stargate · Hacken · 30 Jun 2025Fixed
The report gives no description here.
Open the reportLowUnexpected Return Values Caused by EIP-150 63/64 Gas-Rule in try/catchVeChain / Stargate · Hacken · 30 Jun 2025Fixed
The report gives no description here.
Open the reportLowUseless Repeated Request Exit CallsVeChain / Stargate · Hacken · 30 Jun 2025Fixed
The report gives no description here.
Open the reportLowInadequate Decimal Support and Misleading TypingVechain SDK · CertiK · 3 Mar 2025Fixed
The `Clauses.ts#transferToken()` function is designed to facilitate the transfer of VIP-180 tokens. The VIP-180 standard has been superseded by the ERC20 standard on Ethereum. [VIP-180](https://github.com/vechain/VIPs/blob/master/vips/VIP-180.md): > The VIP-180 has been superseded by the ERC20 standard on Ethereum. Development and usage of VIP-180 are strongly discouraged, and existing implementations are advised to migrate to ERC20. The function's parameter `amount` is of the `VTHO` type, the `VTHO.ts#of()` function restricts decimals to a maximum of 18 (`VTHO.WEI_FD`): ```typescript=54 public static of( value: bigint | number | string | FixedPointNumber, unit: Units = Units.ether ): VTHO { const fpn = value instanceof FixedPointNumber ? value : FixedPointNumber.of(value); return new VTHO( > fpn.div(FixedPointNumber.of(10n ** (VTHO.WEI_FD - BigInt(unit)))) ); } ``` The lack of support for token decimals greater than 18 can be an issue, as outlined in [EIP-20](https://eips.ethereum.org/EIPS/eip-20#specification) or [VIP-180](https://github.com/vechain/VIPs/blob/master/vips/VIP-180.md), this restriction is not imposed. Moreover, the restriction of `amount` to the `VTHO` type is misleading, since it is meant to represent any fungible token's amount.
Open the reportLowInconsistency Between Comment and Code in `generaVechain SDK · CertiK · 3 Mar 2025Fixed
The code snippet provided below shows an incorrect usage where the `generateKey()` function is being called with the `AES-GCM` algorithm. The comment on `Secp256k1.ts#L115` mentions that an ECDSA key pair should be generated, indicating a mismatch between the intended and implemented algorithm: ```typescript=115 // Generate an ECDSA key pair const cryptoKey = await global.crypto.subtle.generateKey( { name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt'] ); ```
Open the reportLowInconsistency Between Comment and Code in `vechaiVechain SDK · CertiK · 3 Mar 2025Fixed
The comment at the pointed locations states `// If the block is successfully fetched (not undefined or null), update the result and increment the block number`. However, the implementation only fetches the block in the `result`, without incrementing the block number: ```ts=258 if (block !== undefined && block !== null) { result = block; // Set the fetched block as the result } ```
Open the reportShow 10 more
LowInconsistent Handling of Unsupported MethodsVechain SDK · CertiK · 3 Mar 2025Fixed
The indicated methods return an empty object as a placeholder at the pointed location since they have not been implemented yet. However, the way unsupported methods are handled is different from the majority of the other unsupported methods. The unsupported methods explicitly return a message indicating the current method is unsupported, while the pointed methods return just an empty object. In this way, if those methods are called they could be interpreted as successfully executed even though they did not execute anything.
Open the reportLowIncorrect Validation of Derivation Path ComponentVechain SDK · CertiK · 3 Mar 2025Fixed
The function `HDKey.ts#isDerivationPathComponentValid()` is intended to validate individual components of a derivation path. The function aims to consider a path component as valid if it is in the format of a "number", "number'", or strictly "m" when the index is 0. However, the current implementation contains a flaw where paths that do not start with "m", but instead with a "number" or "number'", such as '1/0/1', are incorrectly deemed valid. This oversight can lead to incorrect path validation might allow improper derivation paths to be considered valid. Note: the BIP32 path starts with "m" ([BIP-44](https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki)).
Open the reportLowRequest not Sent If `mustReturn0` is TrueVechain SDK · CertiK · 3 Mar 2025Fixed
The function `request()` is returning directly `0x0` if `mustReturn0` is true and the method is `eth_getTransactionCount` without executing the request. Therefore, the flag `mustReturn0` transforms the function `request()` for that particular method to a no-op function.
Open the reportLowUnchecked `block` StringVechain SDK · CertiK · 3 Mar 2025Fixed
The function returns a block based on the input `block` parameter. If the block is a string, it can be either `latest`, `earliest`, `pending`, `finalized`, `safe`, or a hex hash of a block `0x...`. However, if the input `block` is a `string` there is no guarantee it will be limited by those values as it can contain any string value. In that case, the function will return the value as is, thinking it is the hex number of a block.
Open the reportLowConfusing Error MessageVeChain / BaseMarketplace · Hacken · 26 Jul 2024Fixed
The report gives no description here.
Open the reportLowImplementation Contract Can Be Initialized by an External ActorVeChain / BaseMarketplace · Hacken · 26 Jul 2024Fixed
The report gives no description here.
Open the reportLowRedundant Storage Reads Leading to Gas OverheadVeChain / BaseMarketplace · Hacken · 26 Jul 2024Fixed
The report gives no description here.
Open the reportLowCheck-Effect-Interaction Pattern ViolationVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowCode DuplicationVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowDefault State Variable VisibilityVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowFunds Collected By Operators Instead Of By AdminsVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowMissing Event EmittingVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowRedundant _msgSender(), Meta-Transactions Not ImplementedVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowRedundant Conditional StatementVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowRedundant Mapping KeysVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowRedundant SafeMath LibraryVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowRedundant Structure DeclarationVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowRedundant Structure FieldVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowUnclear Require Statement Error StringsVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowUnfinalized CodeVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportShow 5 more
LowUnindexed offerType Events ParameterVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowUnvalidated ParametersVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowUsage of Magic Numbers Instead Of ConstantsVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowUse of uint256 Instead of EnumsVechain Foundation / Marketplace · Hacken · 21 Dec 2023Fixed
The report gives no description here.
Open the reportLowImproved Precision By Multiplication-Before-DivisionVeChain: VVET audit · PeckShield · 27 Aug 2021Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="vechain-foundation"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us