Audit name:
[PT] ZetaChain | Source Code Review | Oct2026 retest
Date:
Nov 6, 2026
Table of Content
Introduction
We express our gratitude to the ZetaChain team for the collaborative engagement that enabled the execution of this Security Assessment.
Velocore is a groundbreaking solution, synthesizing top-tier DEX methodologies into a novel, high-performance flywheel
Document | |
|---|---|
| Name | Secure Code Review and Security Analysis Report for ZetaChain |
| Audited By | Stephen Ajayi |
| Approved By | Ece Orsel |
| Website | https://www.zetachain.com/→ |
| Changelog | 30/01/2025 - Preliminary Report |
| Platform | NAME |
| Language | NAME |
| Tags | NAME |
| Methodology | https://docs.hacken.io/methodologies/dapp-audit-methodology→ |
Document
- Name
- Secure Code Review and Security Analysis Report for ZetaChain
- Audited By
- Stephen Ajayi
- Approved By
- Ece Orsel
- Website
- https://www.zetachain.com/→
- Changelog
- 30/01/2025 - Preliminary Report
- Platform
- NAME
- Language
- NAME
- Tags
- NAME
Review Scope | |
|---|---|
| Repository | https://github.com/velocore/audit→ |
| Commit | 94fc760 |
Review Scope
- Repository
- https://github.com/velocore/audit→
- Commit
- 94fc760
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
{FindingsVulnSeverityStatusTable}
Documentation quality
Functional requirements are partially missed.
Technical description is not provided.
Code quality
The code duplicates commonly known contracts instead of reusing them.
Several template code patterns were found.
The development environment is configured.
Test coverage
Code coverage of the project is 17.99% (branch coverage), with a mutation score of 77%.
Deployment and basic user interactions are covered with tests.
Negative cases coverage is missed.
Interactions by several users are not tested thoroughly.
System Overview
PROJECT_NAME is a staking protocol with the following contracts:
Token — simple ERC-20 token that mints all initial supply to a deployer. Additional minting is not allowed.
It has the following attributes:
Name: TokenName
Symbol: TST
Decimals: 18
Total supply: 100m tokens.
Staking — a contract that rewards users for staking their tokens. APY depends on the tokens provided by the owner and could not be calculated before reward tokens are deposited.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2026-2024 | The claim service can open before the premint launch is complete | fixed | Low |
Appendix 1. Severity Definitions
Findings are categorized based on their potential impact and assigned a severity level using the Common Vulnerability Scoring System (CVSS) version 4.0: →
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following endpoints from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/hknio→ |
| Commit | f185c31beaace0671972d1c2c5be6ea67a8a55e9 |
| Whitepaper | https://hackenio.cc/hacken-methodologies→ |
| Requirements | |
| Technical Requirements |
Scope Details
- Repository
- https://github.com/hknio→
- Commit
- f185c31beaace0671972d1c2c5be6ea67a8a55e9
- Requirements
- Technical Requirements
Appendix 3. Additional Valuables
Frameworks and Methodologies
This security assessment was conducted in alignment with recognised penetration testing standards, methodologies and guidelines, including the NIST SP 800-115 – Technical Guide to Information Security Testing and Assessment →, the Penetration Testing Execution Standard (PTES) →, and the OWASP Testing Guide →. These assets provide a structured foundation for planning, executing, and documenting technical evaluations such as vulnerability assessments, exploitation activities, and security code reviews. Hacken’s internal penetration testing methodology extends these principles to Web2 and Web3 environments to ensure consistency, repeatability, and verifiable outcomes.