Zap Protocol security record
As of 30 Oct 2026, Zap Protocol has 4 audit reports by 2 security firms on Trustblock; the latest is by Zokyo, dated 11 Apr 2024. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| ZAP | Security firm: Zokyo | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Open · IPFS |
| ZAP | Security firm: Zokyo | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Open · IPFS |
| Beefy Zap Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| Beefy Zap Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 critical finding, fixed | Original removed |
Findings50
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 6 |
| High | 0 | 0 | 7 |
| Medium | 0 | 1 | 4 |
| Low | 1 | 1 | 30 |
CriticalIncorrect Claim LogicZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportCriticalReentrance can lead to loss of fundsZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportCriticalUnrestricted call to destroyInstanceZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportCriticalUnrestricted call to setConfigZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportCriticalExternal Call to Permit2 Allows Stealing Users' TokensBeefy Zap Audit · OpenZeppelin · 19 Dec 2023Fixed
The report gives no description here.
Open the reportCriticalExternal Call to Permit2 Allows Stealing Users' TokensBeefy Zap Audit · OpenZeppelin · 29 Jun 2023Fixed
The report gives no description here.
Open the reportHighIncorrect Decimals For unsoldTokensZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportHighIncorrect decimals precisionZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportHighIncorrect Return Of userMaxAllcZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportHighMethod _claim(...) calculates wrong shares and left valuesZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportShow 10 more
HighMethod takeUSDCRaised() transfer wrong fundsZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportHighDenial-of-Service of Router FunctionalityBeefy Zap Audit · OpenZeppelin · 19 Dec 2023Fixed
The report gives no description here.
Open the reportHighDenial-of-Service of Router FunctionalityBeefy Zap Audit · OpenZeppelin · 29 Jun 2023Fixed
The report gives no description here.
Open the reportMediumCentralization due to destroy() methodZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportMediumIncorrect Calculation Of amountFinalZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportMediumLack of ERC20 Token Transfer ValidationZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportMediumMissing disableInitializers Call in Proxy Upgradeable Contract ConstructorZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowBlacklisting is irreversibleZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowCEI pattern not followedZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowChangeable length of vestingPoints leading to issuesZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowFlawed logic in _processPrivate() methodZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowFloating Pragma Version in Solidity FilesZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowImproving Clarity and Functionality of setConfig MethodZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowLack of Event Emission in Privileged FunctionsZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowMissing validation for vesting pointsZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowModifiers duplicatedZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowNon-upgradeable contracts inheritedZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowNon-upgradeable contracts inheritedZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowParameter privateTokenPrice is not validatedZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowRedundant checkZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowRedundant ChecksZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowReentrance Attack Exploit in claim() FunctionZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowRemove console.logZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowThe address of USDB refers to a test chainZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowUnnecessary local variable in method usertaxRate()ZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowUnnecessary Safe Math is being utilizedZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowUnsafe castZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowUnused importsZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowVulnerability to frontrunning due to interplay between claim() and takeUSDCRaised()ZAP · Zokyo · 11 Apr 2024Fixed
The report gives no description here.
Open the reportLowFloating PragmaBeefy Zap Audit · OpenZeppelin · 19 Dec 2023Fixed
The report gives no description here.
Open the reportShow 7 more
LowMissing DocstringsBeefy Zap Audit · OpenZeppelin · 19 Dec 2023Fixed
The report gives no description here.
Open the reportLowMissing Order Typehash Prefix for Witness ParameterBeefy Zap Audit · OpenZeppelin · 19 Dec 2023Fixed
The report gives no description here.
Open the reportLowWitness Type String Does Not Follow EIP-712Beefy Zap Audit · OpenZeppelin · 19 Dec 2023Fixed
The report gives no description here.
Open the reportLowFloating PragmaBeefy Zap Audit · OpenZeppelin · 29 Jun 2023Fixed
The report gives no description here.
Open the reportLowMissing DocstringsBeefy Zap Audit · OpenZeppelin · 29 Jun 2023Fixed
The report gives no description here.
Open the reportLowMissing Order Typehash Prefix for Witness ParameterBeefy Zap Audit · OpenZeppelin · 29 Jun 2023Fixed
The report gives no description here.
Open the reportLowWitness Type String Does Not Follow EIP-712Beefy Zap Audit · OpenZeppelin · 29 Jun 2023Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="zap"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us