Zircuit security record
As of 14 Oct 2026, Zircuit has 4 audit reports by 1 security firm on Trustblock; the latest is by Quantstamp, dated 7 Sep 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Zircuit Finance - Merkle Distributor | Security firm: Quantstamp | Date: | Scope: Not recorded. See the report | No open critical findings | Open · certificate.quantstamp.com |
| Zircuit Finance - Circle CCTP Adapter | Security firm: Quantstamp | Date: | Scope: Not recorded. See the report | No open critical findings | Open · certificate.quantstamp.com |
| Zircuit ZRC | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Zircuit - L2 Upgradeable Contract | Security firm: Quantstamp | Date: | Scope: Repository at commit e76f03c | No open critical findings | Open · certificate.quantstamp.com |
Findings6
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 3 | 3 |
LowIdentical Period Distributions Could Collide on the Same Merkle RootZircuit Finance - Merkle Distributor · Quantstamp · 7 Sep 2026Acknowledged
In `MerkleDistributor`, `leafHash()` commits no distribution identifier, so periods with identical entitlement sets produce the same root and share `claimed` state. `setMerkleRoot()` rejects the repeated root, while the referral synchronization flow reports it as enabled. Prior claimants cannot receive the later payout, and other accounts can receive at most one payout across both periods.
Open the reportLow`maxFeeBps` Has No Hard Compile-Time Ceiling, Unlike the Rest of the Adapter SuiteZircuit Finance - Circle CCTP Adapter · Quantstamp · 29 Apr 2026Acknowledged
`_setMaxFeeBps()` only checks `bps > BPS_DENOMINATOR` (100,000), meaning `SETTER_ROLE` can configure `maxFeeBps` up to 100%, which would allow callers to submit `maxFee` values up to the full transfer amount. While Circle's current protocol fee is capped at 0–14 bps and a caller still chooses their own `maxFee` in `extraData`, the contract-level guard is supposed to be a ceiling on how large that chosen value can be. The parallel `OFTBridgeAdapter` contract in this same package enforces a hard constant `MAX_ALLOWED_FEE_BPS = 100` (1%) that cannot be raised by any admin action — providing a meaningful protocol-level guarantee.
Open the reportLowGas OptimizationsZircuit ZRC · Quantstamp · 26 Nov 2024Acknowledged
We have identified two minor gas optimizations: - The `Distributor.ZRC_ADDRESS` variable can be marked as `immutable`. - The for loops can be gas-optimized by caching the `array.length` in a `memory` variable.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="zircuit"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us