ZIGChain security record
As of 21 Oct 2026, ZIGChain has 5 audit reports by 1 security firm on Trustblock; the latest is by Oak Security, dated 15 May 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits5
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| – ZIGChain audit | Security firm: Oak Security | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| ZIGChain audit | Security firm: Oak Security | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| ZIGChain Update audit | Security firm: Oak Security | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| ZIGChain Reward Contract audit | Security firm: Oak Security | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Open · GitHub |
| ZIGChain audit | Security firm: Oak Security | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Open · GitHub |
Findings101
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 7 |
| High | 0 | 2 | 24 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 21 | 47 |
CriticalPool transfer ante handler is bypassable via authz grants and CosmWasm contract execution– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportCriticalPool transfer ante handler is bypassable via authz grants and CosmWasm contract executionZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportCriticalSent tokens are not refunded when the IBC counterpart failsZIGChain Update audit · Oak Security · 19 Dec 2025Fixed
The report gives no description here.
Open the reportCriticalIncorrect decimal calculations in token amount validationsZIGChain Reward Contract audit · Oak Security · 11 Nov 2025Fixed
The report gives no description here.
Open the reportCriticalUsers can claim past their allowed_amount via cumulative cap bypassZIGChain Reward Contract audit · Oak Security · 11 Nov 2025Fixed
The report gives no description here.
Open the reportCriticalIncorrect token amount can be added to the pool reservesZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportCriticalMalicious chains can send IBC packets to steal funds from the tokenwrapper moduleZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportHighAddLiquidity returns excess deposit coins to the receiver instead of the original sender– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportHighDenial of service on fee withdrawal via unbounded balance iteration on factory module account– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportHighDenial of service on liquidity removal via unbounded balance iteration on pool addresses– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportShow 10 more
HighDEX pool funds are sendable to blocked module addresses via the receiver parameter– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportHighImproper error handling in OnAcknowledgementPacket causes irrecoverable silent fund loss– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportHighMissing ClaimDenomAdmin handler in CosmWasm message plugin– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportHighRecoverZig lacks module address and vesting account blocklists– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportHighAddLiquidity returns excess deposit coins to the receiver instead of the original senderZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportHighDenial of service on fee withdrawal via unbounded balance iteration on factory module accountZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportHighDenial of service on liquidity removal via unbounded balance iteration on pool addressesZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportHighDEX pool funds are sendable to blocked module addresses via the receiver parameterZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportHighImproper error handling in OnAcknowledgementPacket causes irrecoverable silent fund lossZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportHighMissing ClaimDenomAdmin handler in CosmWasm message pluginZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportShow 10 more
HighRecoverZig lacks module address and vesting account blocklistsZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportHighIncorrect address validation in setRewards allows registration to arbitrary EVM walletsZIGChain Reward Contract audit · Oak Security · 11 Nov 2025Fixed
The report gives no description here.
Open the reportHighMissing contract address validation in claim event parsing allows spoofed database entriesZIGChain Reward Contract audit · Oak Security · 11 Nov 2025Fixed
The report gives no description here.
Open the reportHighMissing ValidationPipe and class-transformer enables unvalidated input and injection attacksZIGChain Reward Contract audit · Oak Security · 11 Nov 2025Fixed
The report gives no description here.
Open the reportHighsetRewards lacks anti-spam mechanismZIGChain Reward Contract audit · Oak Security · 11 Nov 2025Fixed
The report gives no description here.
Open the reportHighBurning tokens does not increase minting capacityZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportHighDisabling the tokenwrapper module prevents IBC packets from being transferredZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportHighFees are not incurred during MsgSwapExactOutZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportHighIncorrect token refund mechanism may result in users receiving the wrong tokensZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportHighInsufficient uzig coins in the module balance may cause IBC incoming transfers to failZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportShow 10 more
HighPacket Forward Middleware (PFM) is not implementedZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportLowAttacker-controlled denomination sorting blocks legitimate fee withdrawal– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportLowCompounded rounding error in liquidity addition ratio calculation– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportLowFactory MintAndSendTokens bypasses pool transfer blocking ante handler– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportLowHard error in OnAcknowledgementPacket blocks acknowledgement processing for non-whitelisted channels– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportLowIncomplete genesis invariant validation allowing internally inconsistent module state– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportLowMisleading denomination supply metrics due to inconsistent burn and mint accounting– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportLowMissing rollback in SendPacket after ics4Wrapper.SendPacket failure– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportLowOver-privileged factory module account granting unnecessary staking authority– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportLowPool UID collision possible via separator character in denomination names– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportShow 10 more
LowRate limiter middleware ordering causes incorrect rate limiting for token wrapper transfers– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportLowTruncation rounding in liquidity share calculation slightly favors depositors– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportLowUnvalidated and unused description field in denom creation message– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportLowWASM custom message handlers return nil for events, data, and message responses– ZIGChain audit · Oak Security · 15 May 2026Fixed
The report gives no description here.
Open the reportLowAttacker-controlled denomination sorting blocks legitimate fee withdrawalZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportLowCompounded rounding error in liquidity addition ratio calculationZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportLowFactory MintAndSendTokens bypasses pool transfer blocking ante handlerZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportLowHard error in OnAcknowledgementPacket blocks acknowledgement processing for non-whitelisted channelsZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportLowIncomplete genesis invariant validation allowing internally inconsistent module stateZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportLowMisleading denomination supply metrics due to inconsistent burn and mint accountingZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportShow 10 more
LowMissing rollback in SendPacket after ics4Wrapper.SendPacket failureZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportLowOver-privileged factory module account granting unnecessary staking authorityZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportLowPool UID collision possible via separator character in denomination namesZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportLowRate limiter middleware ordering causes incorrect rate limiting for token wrapper transfersZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportLowTruncation rounding in liquidity share calculation slightly favors depositorsZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportLowUnvalidated and unused description field in denom creation messageZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportLowWASM custom message handlers return nil for events, data, and message responsesZIGChain audit · Oak Security · 5 May 2026Fixed
The report gives no description here.
Open the reportLowCase-insensitive address check allows duplicate reward registrationsZIGChain Reward Contract audit · Oak Security · 11 Nov 2025Fixed
The report gives no description here.
Open the reportLowInsufficient validation of reward token denominationZIGChain Reward Contract audit · Oak Security · 11 Nov 2025Fixed
The report gives no description here.
Open the reportLowLack of API rate limitingZIGChain Reward Contract audit · Oak Security · 11 Nov 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowLack of input validation in multiple instancesZIGChain Reward Contract audit · Oak Security · 11 Nov 2025Fixed
The report gives no description here.
Open the reportLowMissing rate limiting creates documentation inconsistencyZIGChain Reward Contract audit · Oak Security · 11 Nov 2025Fixed
The report gives no description here.
Open the reportLowMissing validation in admin change allows setting invalid or inaccessible admin addressesZIGChain Reward Contract audit · Oak Security · 11 Nov 2025Fixed
The report gives no description here.
Open the reportLowMissing validation of ZigWallet signer enables reward registration to arbitrary addressesZIGChain Reward Contract audit · Oak Security · 11 Nov 2025Fixed
The report gives no description here.
Open the reportLowToken denomination updates invalidate existing claim recordsZIGChain Reward Contract audit · Oak Security · 11 Nov 2025Fixed
The report gives no description here.
Open the reportLowDenomAuth validation function incorrectly rejects empty admin stringsZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportLowImbalanced liquidity deposits can lead to immediate lossZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportLowIncomplete GenesisState validation in the tokenwrapper module may lead to an invalid stateZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportLowIncomplete validation in the Pool function may allow invalid addressesZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportLowIncorrect pagination handling in DenomsByAdmin may lead to inaccurate resultsZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportShow 8 more
LowIncorrect permission handling denies metadata access to bank adminsZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportLowInput string modification before validation violates best practicesZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportLowInsecure default keyring backendZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportLowInsufficient validation of CreateFeeDenom in UpdateParams may prevent denom creationZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportLowLack of cross-validation between DenomList and DenomAuthList may lead to an invalid stateZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportLowMissing MINIMAL_LIQUIDITY lock when minting first depositor share tokensZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportLowMissing upper bound check on decimalDifferenceZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportLowOverwriting fields in ValidateBasic will not persist during actual executionZIGChain audit · Oak Security · 25 Aug 2025Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="zigchain"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us