Zora security record
As of 14 Oct 2026, Zora has 1 audit report on Trustblock, by Quantstamp, dated 11 Jan 2021. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Zora | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings12
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 1 | 1 |
| Medium | 1 | 0 | 0 |
| Low | 3 | 2 | 3 |
HighNFT SquattingZora · Quantstamp · 11 Jan 2021Not fixed
An attacker can front-run transactions and steal the newly minted NFTs. **Update 2021-01-06:** The Zora team presented the following pragmatic mitigation strategy: a user can mint the new media from an unclaimed address and claim such address once the mint has been confirmed. Furthermore, users with stolen tokens and high reputation can denounce such incidents and mint the media with a bit flip instead.
Open the reportMediumMalicious Bid SharesZora · Quantstamp · 11 Jan 2021Not fixed
If a bid share is set to a value that is neither a multiple of 2 nor a multiple of 5, then only bid amounts that are a multiple of $$10^{20}$$ can be accepted. This may render the token untradable. **Update 2021-01-11:** The Zora team suggested the following mitigation tactic. A user with a NFT locked like this can create an ERC20 token for which his balance is $$10^{20}$$ and use this token to make a bid himself on the locked token. The bid can then restore the shares to sane values.
Open the reportLowNFT VandalismZora · Quantstamp · 11 Jan 2021Not fixed
For a small price, spiteful users may deface NFTs before their target acquires them. **Update 2021-01-06:** This is mitigated in a similar manner to QSP-5.
Open the reportLowSeller May Use Psychological Tricks to Induce a Higher PriceZora · Quantstamp · 11 Jan 2021Not fixed
A seller (or another colluding party) may place artificial bids on their own auctions to give gullible users the impression their media is worth more than it actually is.
Open the reportLowURIs are not Signed for MintingZora · Quantstamp · 11 Jan 2021Not fixed
The digest computed in `mintWithSig` does not depend on the media URIs. **Update 2021-01-06:** The issue has been mitigated by paying attention to the URI update events and having the owner fix the URIs if necessary, though a window of time wherein the URIs are defaced still exists.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="zora"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us