As of 24 Oct 2026, Zoro Protocol has 1 audit report on Trustblock, by Quantstamp, dated 31 Jan 2024. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Zoro Protocol | Security firm: Quantstamp | Date: | Scope: Repository at commit da78678 | No open critical findings | Open · certificate.quantstamp.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 1 | 3 | 2 |
The Zoro Protocol uses `block.timestamp` instead of `block.number`. However, there is a check in the `Comptroller._initializeMarket()` function which casts the value returned by `getBlockNumber()` as `uint32` and reverts if the value exceeds `32` bits. The timestamp currently takes `31` bits, which means that the protocol may experience denial of service in the future when the timestamp exceeds a value that can be represented by a number less than `32` bits.
Open the reportThe `Comptroller.getCompAddress()` function returns the hard-coded `COMP` token address deployed on the Ethereum mainnet instead of the governance token of the protocol.
Open the reportThe protocol owner and admin serve privileged roles and can control the configurations of the contract or execute specific functions. Therefore, users are exposed to the risk of being attacked if the privileged roles are compromised. - The `owner` of `BaseJumpRateModelV2` or `DAIInterestRateModelV3` can: - Update the parameters of the interest rate model - The `admin` of `CToken` can: - Set the pending admin of the contract - Set the `Comptroller` and interest rate model addresses - Set the reserve and reduce factors - Initialize the contract after creation - The `admin` of `CErc20` can: - Sweep tokens other than the underlying tokens from the contract - Delegate the votes of the `COMP`-like underlying tokens to an arbitrary address - The `admin` of `CErc20Delegator` can: - Set the implementation contract of this proxy contract - The `admin` of `Unitroller` can: - Set the pending admin of the contract - Set the pending implementation of this proxy contract - The `admin` of `Comptroller` can: - Set the price oracle, borrow cap guardian, and pause guardian addresses - Set the close factor, collateral factor, and borrow cap of a market - Set the liquidation incentive of the protocol - List new markets - Pause the mint and borrow functionality of a market - Pause the transfer of seize operations of the protocol - Assign the implementation contract of a `Unitroller` proxy - Calls `fixBadAccruals()` to adjust the users' accrued `COMP` token - This function was a fix introduced in Compound for Proposal 65 but should be irrelevant to the Zoro protocol
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="zoro-protocol"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us