Zodial security record
As of 20 Oct 2026, Zodial has 1 audit report on Trustblock, by Ackee Blockchain Security, dated 22 Jul 2026. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Zodial | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings47
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 2 |
| Medium | 2 | 1 | 12 |
| Low | 3 | 7 | 19 |
HighLP witness cache and staging paths are permissionless, enabling cache lock, eviction griefing, and attacker-shaped entriesZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportHighReceivership liquidation bypass via dangling LiquidationRecord linkageZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportMediumignore_healthy closeout path skips the premium cap bounding seized collateral by repaid * max_feeZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportMediumkeeper_close_order / close_order rent refund goes to a caller-chosen recipientZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportMediumlending_pool_accrue_bank_interest is not gated by the protocol pauseZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportMediummigrate_curve is permissionless, skips accrue, and skips post-construction validationZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportMediumOperation-type enforcement checks use tolerance without clampingZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportMediumPairwise liq_bonus_bps = 10000 lets lending_account_liquidate produce a zero-repayment seizureZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportMediumPermissionless propagation can override manual staked bank configurationZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportMediumRate-limiter u64 → i64 narrowing is exploitable at configuration and consumption sitesZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportShow 10 more
MediumStaked-with-Pyth-push oracle reads raw SVSP fields incompatible with upstream onramp upgradeZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportMediumStale orders can execute against unrelated positions because tags are reusableZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportMediumToken-2022 transfer-fee mints: outbound vault transfers underpay destinations and inbound integration deposits overcredit depositorsZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportMediumtransfer_to_new_account state migration is incompleteZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowAdmin and delegate mutators bypass protocol pauseZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowclose_balance does not update bank total shares or position countsZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowclose_bank does not verify outstanding-fee counters and can strand collected feesZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowConfiguring rate limits resets limiter windows, allowing history erasure via no-op updatesZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowdeposit_up_to_limit uses pre-accrual capacity, then can fail post-accrualZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowFrozen account authorities can still close orders and clear keeper-close tagsZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportShow 10 more
Lowkeeper_close_order can be bricked by reusing the closed marginfi_account addressZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowlending_account_clear_emissions is permissionlessZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowlending_account_close_balance does not check session flagsZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowlending_pool_update_fees_destinat ion_account does not validate the destination owner or usabilityZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowLP witness staging entries are not bound to the oracle slot they were solved againstZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowmarginfi_account_update_emissions _destination_account does not validate destinationZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowNo bounds validation on global fee parametersZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowPairwise registry accepts dangerous LTV and liquidation- bonus valuesZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowpairwise_row_version uses unix_timestamp and cannot distinguish two updates within the same secondZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowpulse_bank_price_cache is not gated by the protocol pauseZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportShow 3 more
Lowset_fixed_oracle_price accepts arbitrarily large prices and bypasses oracle stalenessZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowshould_skip_rate_limit does not skip order execution flowsZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportLowTokenless-deleveraging banks still contribute full Initial- margin collateralZodial · Ackee Blockchain Security · 22 Jul 2026Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="zodial"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us