W Chain security record
As of 3 Nov 2026, W Chain has 4 audit reports by 1 security firm on Trustblock; the latest is by QuillAudits, dated 25 Dec 2024. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| W Coin Migration Audit Audit · firm’s term: audit | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| W Chain Bridge | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| W Chain Staking | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| W Chain | Security firm: QuillAudits | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · quillaudits.com |
Findings17
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 0 | 1 |
| Low | 5 | 0 | 9 |
LowUse abi.encode instead of abi.encodePackedW Coin Migration Audit · QuillAudits · 25 Dec 2024Open
abi.encodePacked() should not be used with dynamic types when passing the result to ahash function such as keccak256(). Use abi.encode() instead which will pad items to 32 bytes, which will prevent hash collisions (e.g. abi.encodePacked(0x123,0x456) => 0x123456 =>abi.encodePacked(0x1,0x23456), but abi.encode(0x123,0x456) => 0x0...1230...456). Unless there is a compelling reason, abi.encode should be preferred. If there is only one argument to abi.encodePacked() it can often be cast to bytes() or bytes32() instead. If all arguments are strings and or bytes, bytes.concat() should be used instead.
Open the reportLowUse newer librariesW Chain Bridge · QuillAudits · 13 Dec 2024Open
In the newer openzeppelin-contracts implementation (>5.0), the Ownable contract expects to pass the owner address in the constructor, but this doesn’t occur in the WadzBridge.sol contract currently and will revert when compiling from imports of the latest OpenZeppelin contracts.
Open the reportLowMandatory Bridge Requirement Conflicts with L1 Design AssumptionsW Chain · QuillAudits · 18 Nov 2024Open
Current architecture of the code is intertwined with the bridge between rootchain and child chain and it is mandatory to run the bridge to start the blockchain, However As per Wadzchain team, they are L1 and there is no concept of root chain and child chain for them. Current code conflicts the assumption.
Open the reportLowOutdated EVM Support Limited to London HardforkW Chain · QuillAudits · 18 Nov 2024Open
With the current architecture of the chain it only supports till London Hardfork while many other hardfork has been introduced after that in EVM here is the list of it - https://ethereum.org/en/history/ , So current version of wadzchain wouldn’t able to offer the new features and optimisation that has been introduced after. Like support of push0 opcode introduced in paris upgrade however it does not restrict wadzchain to get deployed with the current version of the code but the cavet remain that contracts which are using the solidity compiler version more than 0.8.19 will not be supportable in the wadzchain out of the box.
Open the reportLowParent Repository Archived and No Longer MaintainedW Chain · QuillAudits · 18 Nov 2024Open
Parent repository code as been archived, so no active development and support from the polygon team on polygon-edge code, However polygon introduced a new framework called polygon-cdk which can be used further down the line to keep getting the latest development changes, However wadzchain hast to upgrade the framework to get it supported.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="w-chain-blockchain"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us