Zynk Labs-Solana security record
As of 26 Oct 2026, Zynk Labs-Solana has 2 audit reports by 1 security firm on Trustblock; the latest is by QuillAudits, dated 20 Mar 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Zynk Labs-Solana | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| Zynk Labs V1 | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Findings9
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 1 | 0 | 0 |
| Low | 6 | 0 | 2 |
MediumUse abi.encode instead of abi.encodePackedZynk Labs V1 · QuillAudits · 21 Feb 2025Open
The function checkSum currently uses abi.encodePacked to hash the partnerId. While abi.encodePacked creates a compact encoding, it can lead to potential collisions when concatenating multiple dynamic types. Using abi.encode ensures a more structured encoding, reducing ambiguity and preventing unintended hash collisions.
Open the reportLowMultiple config account vulnerability due to missing PDA constraintsZynk Labs-Solana · QuillAudits · 20 Mar 2025Open
The Config account is initialized as a regular account rather than a program derived address (PDA). The current implementation allows for the creation of multiple Config accounts. The absence of PDA constraints means any address can be used to create a Config account, as long as it's signed by an admin
Open the reportLowCentralization RiskZynk Labs V1 · QuillAudits · 21 Feb 2025Open
Even though all the actors in the protocols are trusted, it is still important to remember that the contract has many points of failure in case of compromised or trusted actors like admin, partners, manager etc.<br><br>
Open the reportLowChange confusing function nameZynk Labs V1 · QuillAudits · 21 Feb 2025Open
The function revokeReplenish() marks an order as active instead of revoking it, which is counterintuitive and can lead to misunderstandings during contract interactions.
Open the reportLowHardcoded chainId might be problematicZynk Labs V1 · QuillAudits · 21 Feb 2025Open
The contract initializes chainId using block.chainid in the constructor, but it does not account for potential chain migrations or forks where chainId may change. This can cause issues with cross-chain validation and future compatibility.<br><br>
Open the reportLowUse ownable2Step instead of OwnableZynk Labs V1 · QuillAudits · 21 Feb 2025Open
<strong> </strong>The contract currently uses direct ownership transfer mechanisms. Using Ownable2Step ensures a safer transfer of ownership by requiring the new owner to accept ownership explicitly before it is finalized. This prevents accidental loss of ownership.
Open the reportLowUse solmate’s safeTransferHelper insteadZynk Labs V1 · QuillAudits · 21 Feb 2025Open
<strong> </strong>The contract currently uses a custom TransferHelper library for token transfers. Solmate’s SafeTransferLib is a more optimized and widely used alternative, providing better gas efficiency and security.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="zynk-labs-solana"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us