zkBob security record
As of 23 Oct 2026, zkBob has 2 audit reports by 2 security firms on Trustblock; the latest is by Decurity, dated 5 Jan 2023. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Zkbob Contracts Cdp audit | Security firm: Decurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| zkBob smart contracts Security Audit | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
Findings24
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 5 | 3 |
| Low | 0 | 3 | 10 |
HighAny token can be transferred from liquidation botZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportHighMint/burn quota bypass in BalancedMinterZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportHighZkBobPool Fees Can Drain the Deposits of the UserzkBob smart contracts Security Audit · ChainSecurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportMediumERC20Permit.receiveWithSaltedPermit Signature Can Be Front-RunzkBob smart contracts Security Audit · ChainSecurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportMediumMissing return value check of the ERC20 transfersZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportMediumUser controlled calls in collectAndIncreaseAmountZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportLowAdmin Reentrancy in ERC20RecoveryzkBob smart contracts Security Audit · ChainSecurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportLowAvoiding Recovery by AdminzkBob smart contracts Security Audit · ChainSecurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportLowBobVault Uint ConversionszkBob smart contracts Security Audit · ChainSecurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportLowDifferences in Oracle implementationsZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportShow 6 more
LowInfinite allowance in _checkAllowanceZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportLowMissing Sanity CheckszkBob smart contracts Security Audit · ChainSecurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportLowMissing workflow invariantsZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportLowNo events emitted on state changesZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportLowNo Events on State ChangeszkBob smart contracts Security Audit · ChainSecurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportLowWrong parameter passed to eventZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="zkbob"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us