Zilliqa security record
As of 22 Oct 2026, Zilliqa has 3 audit reports by 2 security firms on Trustblock; the latest is by Hacken, dated 9 Sep 2026. Those reports list no open critical findings. It also holds 2 deployed contracts on 2 chains.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Zilliqa Ownership Proof | Security firm: Hacken | Date: | Scope: 2 addresses on Ethereum and BNB Chain | No open critical findings | Open · hacken.io |
| Zilliqa / Delegated Staking | Security firm: Hacken | Date: | Scope: 1 address on BNB Chain | No open critical findings | Open · hacken.io |
| Zilliqa | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
Findings33
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 1 | 0 | 11 |
| Low | 2 | 1 | 15 |
High.trim() on the BIP-39 passphrase silently derives a different master keyZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportHighHardcoded hardened-only derivation path locks out all standard BIP-44 walletsZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportHighMissing EIP-55 check and destination confirmation send the balance to a mistyped addressZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportMediumASCII-only mnemonic validator rejects six of the ten wordlistsZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportMediumbech32 decoder in addr20 skips checksum and HRP validationZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportMediumMissing IL < n and childPriv != 0 checks break BIP-32 conformance in CKDHardenedZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportMediumMissing length validation on decoded addresses in ProofServiceZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportMediumMnemonic checksum validation is optional and English-only, silently skipping on non-English mnemonics or a missing dependencyZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportMediumstdin is not checked for TTY before prompting, so the "hidden" mnemonic prompt can silently echo in cleartextZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportMediumUnconstrained newAddr and domain desynchronize the proof from the on-chain addressZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportShow 10 more
MediumUnnormalized U+3000 separator rejects Japanese phrases typed with a regular spaceZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportMediumMissing New Address Staking Data Check for replaceOldAddress functionZilliqa / Delegated Staking · Hacken · 4 Apr 2025Fixed
The report gives no description here.
Open the reportMediumPotential Denial of Service due to Iteration Over All Validators During Deposits UpdatesZilliqa / Delegated Staking · Hacken · 4 Apr 2025Fixed
The report gives no description here.
Open the reportMediumUnauthorized Reinitialization Permits Arbitrary State MigrationZilliqa / Delegated Staking · Hacken · 4 Apr 2025Fixed
The report gives no description here.
Open the reportLowDuplicated zkey path bypasses DownloadService and is not re-verified before provingZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportLowLocally generated proof is not verified before the user is told to submit itZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportLowMislabeled xprv Input Field Invites Users to Submit Incompatible Private Key MaterialZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportLowMissing canonical-padding check in bech32ToBytesZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportLowSilent truncation in _bigIntToUint256 hides oversized values instead of erroringZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportLowUnconstrained hardened-index binding in CKDFinalStep allows proving ownership at any hardened index, not just 0'Zilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportShow 9 more
LowUnused LedgerDerive template in bip32lib.circomZilliqa Ownership Proof · Hacken · 9 Sep 2026Fixed
The report gives no description here.
Open the reportLowCentralized Control Address SettingZilliqa / Delegated Staking · Hacken · 4 Apr 2025Fixed
The report gives no description here.
Open the reportLowCommission Rate Configuration Allows Excessively High RatesZilliqa / Delegated Staking · Hacken · 4 Apr 2025Fixed
The report gives no description here.
Open the reportLowFloating PragmaZilliqa / Delegated Staking · Hacken · 4 Apr 2025Fixed
The report gives no description here.
Open the reportLowIncorrect Comments in Function for Version Change in BaseDelegation ContractZilliqa / Delegated Staking · Hacken · 4 Apr 2025Fixed
The report gives no description here.
Open the reportLowInefficient Handling of Zero-Amount Stakings in Reward CalculationZilliqa / Delegated Staking · Hacken · 4 Apr 2025Fixed
The report gives no description here.
Open the reportLowLack of Events In DelegationsZilliqa / Delegated Staking · Hacken · 4 Apr 2025Fixed
The report gives no description here.
Open the reportLowMissing Non-Zero Address ValidationsZilliqa / Delegated Staking · Hacken · 4 Apr 2025Fixed
The report gives no description here.
Open the reportLowRedundant State Change in Activation Flag Results in Unnecessary Gas UsageZilliqa / Delegated Staking · Hacken · 4 Apr 2025Fixed
The report gives no description here.
Open the reportContracts2
| Address | Chain | Source code |
|---|---|---|
| 0x05f4a42e251f2d52b8ed15e9fedaacfcef1fad27 | Chain: Ethereum | Source code: Verified source |
| 0xb86abcb37c3a4b64f74f59301aff131a1becc787 | Chain: BNB Chain | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="zilliqa"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us