Zoksh Pay security record
As of 25 Oct 2026, Zoksh Pay has 1 audit report on Trustblock, by QuillAudits, dated 10 Jul 2023. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Zoksh | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Findings18
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 0 | 1 |
| Medium | 2 | 0 | 1 |
| Low | 10 | 0 | 2 |
HighInitial fee amount can cause a loss of funds to merchantsZoksh · QuillAudits · 10 Jul 2023Fixed
The GatewayFactory contract has the variable setFee initialized to 100. From the calculations in _settle() on L112 this would cause 100% of the amount to be deducted as fees, this way preventing the merchant from withdrawing any amounts and transferring all tokens to the gatewayAddr.
Open the reportMediumUse .call( ) instead of .send( )Zoksh · QuillAudits · 10 Jul 2023Fixed
In GatewayRoute, function settle() and refund() send is used for transferring the ether. Future changes or forks in Ethereum can result in higher gas fees than send provides. The .send() creates a hard dependency on 2300 gas units being appropriate now but not in the future. This may also affect functionality when a multi-sig wallet is used for such interactions.
Open the reportLowNaming ConventionZoksh · QuillAudits · 10 Jul 2023Fixed
The naming convention used in the codebase is not clear and reduces the readability of the entire codebase. The terms manager and merchant are used concurrently but they could refer to different entities.In GatewayFactory, the onlyManager() modifier checks that the caller is the same as the merchantAddr address provided in the Administrable (GatewayAccess) contract. Since the check is for the merchant and not the manager, it can be changed to onlyMerchant(). In GatewayRoute, the onlyMerchant() modifier checks that the caller is the same as the managerAddr address provided in the creation of the GatewayRoute contract. Since the check is for the manager and not the manager, it can be changed to onlyManager().
Open the reportLowPrivilege delegationZoksh · QuillAudits · 10 Jul 2023Fixed
From GatewayFactory, the creation of a route can happen with createRoute() or deployRoute(). When routes are created using deployRoute() the merchant address and manager address are the same (msg.sender), but with createRoute() the manager can be any value passed in. The issue here is that the merchant no longer has the privileges to call onlyMerchant() functions if a separate manager is set when calling createRoute().
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="zoksh-pay"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us