Zap — Wallet Contracts

Audit report published Mar 2025. Fuel · Sway.

Findings at a glance

Severity	Count
High	2
Low	2
Informational	1
Total	5

Summary

Safe Edges reviewed Zap's Sway wallet contracts on Fuel. Five issues were identified: two High, two Low and one Informational. The High issues were an asset check in Module 5 that required both outputs to be the base asset, blocking native asset transfers, and a race in initialize_wallet that lets parallel transactions mint duplicate nonce assets for the same wallet. H-01 was fixed with a published patch; the original records the remaining issues as needing fixes.

Read the full report (PDF).

Findings

High (2)

• H-01 Asset validation is not properly implemented in Module 5 — Resolved
• H-02 Wallet Initialization Race Condition

Low (2)

• L-01 Zero Address Check Missing in Ownership Transfer — Open
• L-02 Unused Variable upperb_ovf — Open

Informational (1)

• I-01 Contract Pause Check Missing on Version Update — Open

More published reports

Related services

Get a fixed quote in 24 hours

Send the repository and a commit hash through the contact form, message @bugtester25 on Telegram, or book a 30-minute scoping call. 200+ protocols audited · $4B+ secured · 0 hacks post-audit. Prefer email? info@safeedges.in.