zkBob security record
As of 23 Oct 2026, zkBob has 2 audit reports by 2 security firms on Trustblock; the latest is by Decurity, dated 5 Jan 2023. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Zkbob Contracts Cdp audit | Security firm: Decurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| zkBob smart contracts Security Audit | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
Findings24
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 5 | 3 |
| Low | 0 | 3 | 10 |
Marked Info by the firms. Not counted as findings.
InfoMissing isContract check for EIP1967 proxy implementationZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Acknowledged
The report gives no description here.
Open the reportInfoNon-optimal conditional statementsZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Acknowledged
The report gives no description here.
Open the reportInfoString error messages used instead of custom errorsZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Acknowledged
The report gives no description here.
Open the reportInfoUnnecessary checked arithmetic in loopZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Acknowledged
The report gives no description here.
Open the reportInfoUnused function parameterZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Acknowledged
The report gives no description here.
Open the reportInfoVariable can be set as immutableZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Acknowledged
The report gives no description here.
Open the reportInfoCache array length outside the loopZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportInfoCalldata location can be used instead of memoryZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportInfoInconsistent variable naming styleZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportInfoLocal variable shadowingZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportShow 9 more
InfoMissing 0x0 check on input addressesZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportInfoMissing check that batch_deposit_verifier is contractZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportInfoMissing zero transfer token amount check in ZkBobPoolZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportInfoNon-optimal increment/decrementZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportInfoOutdated OpenZeppelin libraryZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportInfoUnnecessary calculations in BaseERC20Zkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportInfoUnused modifierZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportInfoUnused variablesZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportInfoVariable can be cachedZkbob Contracts Cdp audit · Decurity · 5 Jan 2023Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="zkbob"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us