As of 14 Oct 2026, Virtual Versions has 1 audit report on Trustblock, by CertiK, dated 30 Mar 2023. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Unuslabs - Audit | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 8 | 0 | 0 |
In the contract `TokenVesting` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and add beneficiaries to the private round of investors, release vested tokens, and withdraw tokens from the contract. 
Open the reportTokens are sent to owner when deploying the contract. This could be a centralization risk as the owner can distribute tokens without obtaining the consensus of the community.
Open the reportThe linked comment statement contains a typo in its body, namely `tockens`.
Open the reportThe following function is declared as `public`. Functions that are never called internally within the contract should have `external` visibility.
Open the reportPragma should be locked to specific compiler version and flags that they have been tested the most with. Locking the pragma helps ensure that contracts do not accidentally get deployed using, for example, the latest compiler, which may have higher risks of undiscovered bugs.
Open the reportState variables that never change should be declared as `constant` to save gas. ```solidity=41 uint256 private slicePeriodSeconds = MONTH; ``` - `slicePeriodSeconds` should be declared `constant`.
Open the reportLiterals with many digits are difficult to read and review.
Open the reportThe return value of the transfer()/transferFrom() call is not checked. ```solidity=263 token.transfer(_msgSender(), balance); ```
Open the report`block.timestamp` is used for comparison, which can be risky since timestamp can be influenced by miners. That means the miner creating the block can manipulate the `block.timestamp`, to some degree, and change the outcome of the transaction. ```solidity=116 vestingStartTS = block.timestamp; ``` --- ```solidity=147 privateRoundInvestors[_beneficiary] = PrivateRoundInvestor( _amount, 0, block.timestamp ); ``` --- ```solidity=212 uint256 currentTime = block.timestamp; ``` --- ```solidity=237 uint256 currentTime = block.timestamp; ``` --- ```solidity=270 uint256 currenttime = block.timestamp; ```
Open the reportIt is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=256 to.transfer(amount); ``` - `TokenVesting.withdrawEth` uses `transfer()`.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="vv-token"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us