As of 3 Nov 2026, Yugcoins has 3 audit reports by 1 security firm on Trustblock; the latest is by QuillAudits, dated 8 Dec 2022. Those reports list 1 critical acknowledged and not fixed. It also holds 2 deployed contracts on 1 chain.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| yugcoins | Security firm: QuillAudits | Date: | Scope: 2 addresses on BNB Chain | 1 critical acknowledged, not fixed | Open · IPFS |
| TRG | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| yugcoins | Security firm: QuillAudits | Date: | Scope: 2 addresses on BNB Chain | No open critical findings | Open · quillaudits.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 1 |
| High | 1 | 0 | 2 |
| Medium | 1 | 0 | 6 |
| Low | 3 | 2 | 10 |
- If setsTrg() function is not called before the deposit() in the STRG starts, then it will lead to incorrect calculation of pendingRewards and dividendPerToken. By default the sTrg variable be a zero address.
Open the reportThe onlyOwner functions such as changeCult(), changeDCult(), changeTrg() and emergencyRemoveToken() can be exploited by a malicious admin resulting in a potential Denial of Service attack to users. For example, if the cult and the trg address is changed by a malicious admin to point to some other address, the users will not be able to call the bribe() function because it will lead to execution of the if statement on line: 163 resulting in Denial of Service attack. Additionally emergencyRemoveToken() can be used by a malicious admin to remove tokens that are unfavourable to the winning conditions and can be used to manipulate the game.
Open the reportThere are two contracts with similar names in the codebase, TheRugGame and THERUGGAME. It could be more convenient to have the names more explicit and less similar.
Open the reportThe staking in STRG contract has no time delay. As a result, there is no incentive for users to stake for a longer time once the rewards in TRG tokens are allocated by the admin to the STRG contract.
Open the reportThere is supply variable that has been used as a parameter in the constructor to mint a specific supply of tokens. But this does not guarantee that there won't be any more tokens minted apart from this supply which can be misleading.
Open the report| Address | Chain | Source code |
|---|---|---|
| 0x04c8…34960x04c8238663631cd88c0a2dd9f27b6655b6a83496 | Chain: BNB Chain | Source code: Verified source |
| 0xf3fd…5ef20xf3fd85ec9eaf17e469ebad5d6027282ebc7a5ef2 | Chain: BNB Chain | Source code: Verified source |
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="yugcoins"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us