XMAQUINA security record
As of 10 Nov 2026, XMAQUINA has 1 audit report on Trustblock, by Halborn, dated 21 Sep 2026. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits1
Newest first
| Report | Security firm | Date | Scope | Critical findings | Source |
|---|---|---|---|---|---|
| Managed Smart Contract Assessment | Security firm: Halborn | Date: | Scope: Not recorded; see the report | None open | halborn.com ↗ |
Findings46
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 2 | 1 |
| Low | 0 | 5 | 5 |
Marked Informational by the firms. Not counted as findings.
InformationalA reused library address from a previous build passes the deployment check and runs stale logic on every seriesManaged Smart Contract Assessment · Halborn · 21 Sep 2026Acknowledged
The report gives no description here.
Open the reportInformationalAn eligibility entry can be written with a practically infinite expiry, contradicting the no immortal entries ruleManaged Smart Contract Assessment · Halborn · 21 Sep 2026Acknowledged
The report gives no description here.
Open the reportInformationalCancelling notes during settlement, rolling back and declaring again raises every remaining holder's payout rateManaged Smart Contract Assessment · Halborn · 21 Sep 2026Acknowledged
The report gives no description here.
Open the reportInformationalClawback accepts the note's own address as destination, unlike every other destination setterManaged Smart Contract Assessment · Halborn · 21 Sep 2026Acknowledged
The report gives no description here.
Open the reportInformationalDuplicate wallets in one registry batch are accepted and the last row silently winsManaged Smart Contract Assessment · Halborn · 21 Sep 2026Acknowledged
The report gives no description here.
Open the reportInformationalNo floor on the certified completion date lets claims open in the issuance blockManaged Smart Contract Assessment · Halborn · 21 Sep 2026Acknowledged
The report gives no description here.
Open the reportInformationalPhase transition and engine change events do not record who actedManaged Smart Contract Assessment · Halborn · 21 Sep 2026Acknowledged
The report gives no description here.
Open the reportInformationalThe payout pool is credited before the tokens arrive, so a short delivery records a liability the escrow cannot payManaged Smart Contract Assessment · Halborn · 21 Sep 2026Acknowledged
The report gives no description here.
Open the reportInformationalA series can be created with another series' escrow as its off ramp, stranding the swept raise in the wrong custody poolManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalA series can name its own escrow as the off ramp, so the sweep moves nothing and notes are issued against money that never leftManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalA subscription end near the maximum timestamp overflows the deadline arithmetic and disables the permissionless fallbackManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalAn oversized settlement amount overflows the payout arithmetic and stalls every redemption until the declaration is rolled backManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalBurn NatSpec still describes the frozen shortfall release removed with the lock upManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalClosing redemption before any burn removes the only correction window for a wrong settlement basisManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalDeposit, claim and redemption each signal ineligibility differently despite the interface promiseManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalFallback buffers and the heartbeat step accept a one second value, which defeats the protections the zero check exists forManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalFive mutators still succeed on a terminal series that INV-12 does not listManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalIn kind deliveries lose the transfer tax and the exchanging holder receives fewer notes than agreedManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalIntegrator documentation misstates which parameters move after open and cites a validator that does not existManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalInterface documentation for claim delivery still describes the removed lock up freezeManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalInterface text for issuance points at a mechanism the token replacedManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalThe compromise response table routes every recovery through a key that has no response row of its ownManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalThe deploy checklist states that RCMNote.forcedTransfer() reverts from the admin when it succeedsManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalThe escrow and admin role collision checks run only at initialisation and a later grant reestablishes what they rejectManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalThe factory accepts a role set that collides the admin with an operational role, and every series creation then failsManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalThe identity policy header states that the scale back gate is unbuilt when two of its three call sites are liveManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalThe implied upper bound on the overage cap scales with the square of the hardcap and provides no sanity checkManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalThe lens header claims every read is guarded by the escrow when two note reads are not, and safety rests on call orderManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalThe lens recomputes outstanding supply instead of reading the escrow's accessor for itManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalThe note's decimals are not validated against the settlement asset, so a wrong value misrepresents every balance for the life of the seriesManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportShow 3 more
InformationalThe operations role map omits the document engine as a fifth contract that grants rolesManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalThe parameter freeze holds by the absence of setters, not by the predicate that claims to define itManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalThe specification's pointer swap principle names two examples that are frozen in codeManaged Smart Contract Assessment · Halborn · 21 Sep 2026Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="xmaquina"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us