VenomBridge / Bridge

Hacken22 Nov 2023Files named in the report

Hacken reviewed Venom Foundation (VenomBridge / Bridge) on 22 Nov 2023: 94 findings, 1 critical; 70 marked fixed, 24 open.

1 critical finding, fixed

Open the report Open Venom Foundation’s security record

Report hosted on hacken.io.

Trustblock does not review code.

Findings94

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	1
High	1	0	2
Medium	9	0	18
Low	14	0	49

CriticalShare Inflation and Front-Running in MultiVault ContractsFixed

The report gives no description here.

HighFunds Loss Due To Initialization Front RunFixed

The report gives no description here.

HighInvalid Fee Beneficiary Handling for Zero LiquidityFixed

The report gives no description here.

MediumCentralization Risk Due to Owner's Access to User Funds in ProxyMultiVaultAlien ContractFixed

The report gives no description here.

MediumFunds Lock Due To Initialization Front Run PrepaidFixed

The report gives no description here.

MediumHigh Permissions May Lead to Data InconsistencyFixed

The report gives no description here.

MediumIncorrect Alien Token Value Passed in the _callbackAlienWithdrawal() FunctionFixed

The report gives no description here.

MediumIncorrect Funds Receiver On Early Event DestructionFixed

The report gives no description here.

MediumInefficient Gas Management in EthereumEverscaleEventConfiguration ContractFixed

The report gives no description here.

MediumMismanagement of fee-on-transfer Tokens in Deposit FacetFixed

The report gives no description here.

Show 10 more

MediumMismanagement of fee-on-transfer Tokens in Liquidity FacetFixed

The report gives no description here.

MediumMissing Validation for Wrapped Native Asset in UnwrapNativeToken ContractFixed

The report gives no description here.

MediumOutdated OpenZeppelin Contracts UsedFixed

The report gives no description here.

MediumOwnership IrrevocabilityFixed

The report gives no description here.

MediumPotential Funds Lock on Event Rejection in EVM to TVM BridgeFixed

The report gives no description here.

MediumPotential WETH Address ManipulationFixed

The report gives no description here.

MediumSignature Malleability Due to Outdated ECDSA LibraryFixed

The report gives no description here.

MediumTransaction Replay Possibility in close() FunctionFixed

The report gives no description here.

MediumTransaction Replay Possibility in deployEvents() FunctionFixed

The report gives no description here.

MediumTransaction Replay Possibility in queue() FunctionFixed

The report gives no description here.

Show 10 more

MediumUnrestricted Access to deploy() Function in StakingRootDeployer.tsol ContractFixed

The report gives no description here.

LowCEI Violation With Event EmissionFixed

The report gives no description here.

LowCommented-out Code in ProxyMultiVaultAlien_V7.tsol ContractFixed

The report gives no description here.

LowContract Name ReuseFixed

The report gives no description here.

LowContradictory Documentation on Event Confirmation and RejectionFixed

The report gives no description here.

LowDocumentation Mismatch Regarding Function Access in Multiple FunctionsFixed

The report gives no description here.

LowDocumentation Mismatch Regarding Native vs. Alien Tokens in ProxyMultiVaultNative_V5_Deposit.tsolFixed

The report gives no description here.

LowFloating Pragma in .tsol FilesFixed

The report gives no description here.

LowHardcoded Values and Magic Numbers in StakingBase.tsol Contract Initialization of RelayConfigDetailsFixed

The report gives no description here.

LowInaccurate Comment on Relay Membership Lock Time in UserData.tsolFixed

The report gives no description here.

Show 10 more

LowIncorrect int Type Size Used in EverscaleAddress StructFixed

The report gives no description here.

LowIncorrect Interface Version UsedFixed

The report gives no description here.

LowIncorrect Remaining Gas Receiver Of TokenRootAlienEVM Deployment Funded By Contract ItselfFixed

The report gives no description here.

LowInefficient Event Emission in MultiVault Facet SettingsFixed

The report gives no description here.

LowInefficient Token Existence Check in Bulk OperationsFixed

The report gives no description here.

LowInvalid Balance Sanity Check in withdrawTonsEmergency() FunctionFixed

The report gives no description here.

LowMissing cashBack Modifier in Various FunctionsFixed

The report gives no description here.

LowMissing Function Declarations in Interfaces IDAO.sol and IBridge.solFixed

The report gives no description here.

LowMissing Revert Error Codes in require() StatementsFixed

The report gives no description here.

LowMissing Storage GapsFixed

The report gives no description here.

Show 10 more

LowMissing Validation in _getNativeWithdrawalToken() FunctionFixed

The report gives no description here.

LowMissing Validation in DaoRoot.tsolFixed

The report gives no description here.

LowMissing Visibility ModifiersFixed

The report gives no description here.

LowMissing Zero Address CheckFixed

The report gives no description here.

LowMissing Zero Address Checks in Bridge.tsolFixed

The report gives no description here.

LowMissing Zero Address Checks in DaoRoot.tsolFixed

The report gives no description here.

LowMissing Zero Address ValidationFixed

The report gives no description here.

LowMissing Zero Address Validation in StakingBase.tsolFixed

The report gives no description here.

LowName Contradiction In MultiVaultStorage ContractFixed

The report gives no description here.

LowNot Explicit Interface UsageFixed

The report gives no description here.

Show 10 more

LowPossible Not Implemented Emergency Shutdown Functionality in Bridge.solFixed

The report gives no description here.

LowPotential Underflow in _deposit() FunctionFixed

The report gives no description here.

LowPresence of Unused Test Contracts in Production CodebaseFixed

The report gives no description here.

LowRedundant Check in saveWithdrawNative() FunctionFixed

The report gives no description here.

LowRedundant Code in DiamondProxy Storage FunctionsFixed

The report gives no description here.

LowRedundant Code Pattern in removeToken() FunctionFixed

The report gives no description here.

LowRedundant Function Addition Logic in DiamondProxy Storage FunctionsFixed

The report gives no description here.

LowRedundant FunctionsFixed

The report gives no description here.

LowRedundant Import StatementsFixed

The report gives no description here.

LowRedundant Inheritance of MultiVaultHelperEverscale in MultiVaultFacetFees ContractFixed

The report gives no description here.

Show 10 more

LowRedundant Modifier in Delegate ContractFixed

The report gives no description here.

LowRedundant State Update in BaseEventFixed

The report gives no description here.

LowRedundant Usage of Experimental ABI Encoder in Solidity ^0.8.0Fixed

The report gives no description here.

LowRedundant Zero-Check Logic in MultiVault Token Fee Increase FunctionFixed

The report gives no description here.

LowSolidity Style Guides ViolationFixed

The report gives no description here.

LowTest-only Contract Not In Mock/Test FolderFixed

The report gives no description here.

LowTODO Comments in Production CodeFixed

The report gives no description here.

LowUnlimited Event Size Allows Relayer To Burn Service Contract BalanceFixed

The report gives no description here.

LowUnused ModifiersFixed

The report gives no description here.

LowWrapping Address to Contract Implementation Instead of InterfaceFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (209)

ethereum/contracts/multivault/interfaces/proxy/draft-IERC1822.sol
ethereum/contracts/multivault/MultiVaultToken.sol
ethereum/contracts/multivault/multivault/facets/MultiVaultFacetTokens.sol
ethereum/contracts/multivault/multivault/facets/MultiVaultFacetFees.sol
ethereum/contracts/multivault/interfaces/IERC165.sol
everscale/contracts/utils/Wallet.tsol
dao/interfaces/IDaoRoot.tsol
ethereum/contracts/interfaces/IEverscale.sol
everscale/contracts/bridge/proxy/multivault/alien/V7/ProxyMultiVaultAlien_V7_Token.tsol
everscale/contracts/bridge/interfaces/IRound.tsol
everscale/contracts/staking/interfaces/ITokensReceivedCallback.tsol
ethereum/contracts/multivault/multivault/storage/MultiVaultStorageReentrancyGuard.sol
everscale/contracts/staking/StakingRootDeployer.tsol
everscale/contracts/staking/libraries/Gas.tsol
dao/structures/ActionStructure.tsol
ethereum/contracts/multivault/interfaces/multivault/IMultiVaultFacetTokensEvents.sol
everscale/contracts/staking/base/StakingUpgradable.tsol
everscale/contracts/staking/interfaces/IUserData.tsol
dao/interfaces/IUpgradable.tsol
dao/Proposal.tsol
ethereum/contracts/multivault/utils/Initializable.sol
everscale/contracts/bridge/event-contracts/multivault/evm/MultiVaultEVMEverscaleEventNative.tsol
ethereum/contracts/multivault/multivault/helpers/MultiVaultHelperFee.sol
ethereum/contracts/multivault/utils/ReentrancyGuard.sol
everscale/contracts/bridge/proxy/multivault/alien/V7/ProxyMultiVaultAlien_V7_MergeRouter.tsol
ethereum/contracts/libraries/ECDSA.sol
everscale/contracts/bridge/event-contracts/base/evm/EverscaleEthereumBaseEvent.tsol
ethereum/contracts/multivault/interfaces/IERC20Metadata.sol
ethereum/contracts/utils/ReentrancyGuard.sol
ethereum/contracts/multivault/interfaces/multivault/IMultiVaultFacetPendingWithdrawals.sol
ethereum/contracts/multivault/interfaces/multivault/IMultiVaultFacetLiquidityEvents.sol
everscale/contracts/bridge/interfaces/event-contracts/multivault/evm/IEVMCallback.tsol
ethereum/contracts/multivault/interfaces/proxy/IBeacon.sol
everscale/contracts/utils/cell-encoder/ProxyTokenTransferCellEncoder.tsol
everscale/contracts/bridge/proxy/multivault/alien/V7/ProxyMultiVaultAlien_V7.tsol
ethereum/contracts/bridge/StakingRelayVerifier.sol
ethereum/contracts/multivault/multivault/helpers/MultiVaultHelperCallback.sol
everscale/contracts/bridge/Connector.tsol
everscale/contracts/staking/interfaces/IStakingPool.tsol
everscale/contracts/bridge/alien-token/TokenRootAlienEVM.tsol
everscale/contracts/utils/ErrorCodes.tsol
everscale/contracts/bridge/interfaces/IEventNotificationReceiver.tsol
ethereum/contracts/interfaces/IRewards.sol
everscale/contracts/staking/StakingV1_2.tsol
dao/interfaces/IUpgradableByRequest.tsol
ethereum/contracts/utils/UnwrapNativeToken.sol
everscale/contracts/bridge/interfaces/proxy/INetworks.tsol
everscale/contracts/utils/cell-encoder/MergePoolCellEncoder.tsol
ethereum/contracts/multivault/interfaces/multivault/IMultiVaultFacetLiquidity.sol
everscale/contracts/bridge/proxy/multivault/alien/V7/ProxyMultiVaultAlien_V7_Deposit_Solana.tsol
everscale/contracts/staking/Staking.tsol
everscale/contracts/bridge/event-configuration-contracts/evm/EthereumEverscaleEventConfiguration.tsol
everscale/contracts/bridge/interfaces/alien-token-merge/IMergeRouter.tsol
ethereum/contracts/multivault/multivault/helpers/MultiVaultHelperEverscale.sol
everscale/contracts/bridge/interfaces/IBridge.tsol
everscale/contracts/bridge/libraries/EventContractNonce.tsol
everscale/contracts/bridge/interfaces/proxy/IEthereumEverscaleProxyExtended.tsol
ethereum/contracts/multivault/interfaces/IMultiVaultToken.sol
everscale/contracts/bridge/interfaces/event-contracts/IBasicEvent.tsol
everscale/contracts/staking/interfaces/IStakingDao.tsol
everscale/contracts/bridge/event-contracts/multivault/evm/MultiVaultEVMEverscaleEventAlien.tsol
everscale/contracts/bridge/proxy/multivault/native/V5/ProxyMultiVaultNative_V5.tsol
dao/libraries/Gas.tsol
ethereum/contracts/multivault/libraries/Address.sol
ethereum/contracts/multivault/proxy/Proxy.sol
ethereum/contracts/multivault/interfaces/multivault/IMultiVaultFacetWithdrawEvents.sol
ethereum/contracts/multivault/interfaces/multivault/IMultiVaultFacetTokens.sol
ethereum/contracts/multivault/multivault/facets/DiamondLoupeFacet.sol
ethereum/contracts/multivault/multivault/helpers/MultiVaultHelperTokenBalance.sol
everscale/contracts/bridge/interfaces/event-configuration-contracts/IBasicEventConfiguration.tsol
ethereum/contracts/multivault/libraries/SafeERC20.sol
ethereum/contracts/interfaces/ICallExecutor.sol
everscale/contracts/staking/RelayRound.tsol
ethereum/contracts/multivault/interfaces/IBridge.sol
everscale/contracts/bridge/interfaces/IStaking.tsol
ethereum/contracts/interfaces/IBridge.sol
everscale/contracts/bridge/event-contracts/dao/DaoEthereumActionEvent.tsol
dao/interfaces/IStakingAccount.tsol
everscale/contracts/bridge/proxy/multivault/alien/V7/ProxyMultiVaultAlien_V7_Withdraw.tsol
everscale/contracts/utils/cell-encoder/StakingCellEncoder.tsol
everscale/contracts/bridge/Bridge.tsol
ethereum/contracts/libraries/Address.sol
ethereum/contracts/multivault/multivault/facets/DiamondCutFacet.sol
everscale/contracts/staking/libraries/PlatformTypes.tsol
ethereum/contracts/multivault/interfaces/IERC173.sol
ethereum/contracts/utils/Token.sol
dao/libraries/DaoErrors.tsol
ethereum/contracts/interfaces/IDAO.sol
ethereum/contracts/multivault/interfaces/IDiamondCut.sol
everscale/contracts/bridge/interfaces/alien-token-merge/merge-pool/IMergePool_V2.tsol
ethereum/contracts/multivault/multivault/helpers/MultiVaultHelperEmergency.sol
everscale/contracts/bridge/alien-token-merge/merge-pool/MergePool_V4.tsol
ethereum/contracts/multivault/libraries/Context.sol
ethereum/contracts/multivault/multivault/helpers/MultiVaultHelperPendingWithdrawal.sol
ethereum/contracts/multivault/interfaces/multivault/IMultiVaultFacetSettings.sol
everscale/contracts/bridge/interfaces/event-contracts/multivault/evm/IMultiVaultEVMEverscaleEventAlien.tsol
everscale/contracts/bridge/interfaces/event-configuration-contracts/IEverscaleEthereumEventConfiguration.tsol
ethereum/contracts/libraries/Clones.sol
ethereum/contracts/utils/Initializable.sol
ethereum/contracts/multivault/interfaces/multivault/IMultiVaultFacetDepositEvents.sol
ethereum/contracts/multivault/multivault/facets/MultiVaultFacetWithdraw.sol
everscale/contracts/bridge/alien-token-merge/MergeRouter.tsol
everscale/contracts/utils/TransferUtils.tsol
ethereum/contracts/multivault/interfaces/multivault/IMultiVaultFacetWithdraw.sol
ethereum/contracts/utils/BatchSaver.sol
ethereum/contracts/multivault/libraries/StorageSlot.sol
everscale/contracts/bridge/alien-token/AlienTokenWalletPlatform.tsol
ethereum/contracts/interfaces/IERC20.sol
ethereum/contracts/multivault/multivault/storage/MultiVaultStorage.sol
ethereum/contracts/multivault/interfaces/IEverscale.sol
ethereum/contracts/multivault/interfaces/multivault/IMultiVaultFacetFeesEvents.sol
everscale/contracts/bridge/interfaces/IConnector.tsol
dao/structures/DaoPlatformTypes.tsol
ethereum/contracts/multivault/interfaces/multivault/IMultiVaultFacetDeposit.sol
everscale/contracts/bridge/interfaces/proxy/multivault/native/IProxyMultiVaultNative_V3.tsol
ethereum/contracts/multivault/multivault/helpers/MultiVaultHelperWithdraw.sol
everscale/contracts/staking/base/StakingRelay.tsol
ethereum/contracts/multivault/proxy/TransparentUpgradeableProxy.sol
everscale/contracts/bridge/alien-token/AlienTokenWalletUpgradeable.tsol
everscale/contracts/bridge/factory/EthereumEverscaleEventConfigurationFactory.tsol
ethereum/contracts/multivault/multivault/helpers/MultiVaultHelperInitializable.sol
ethereum/contracts/multivault/multivault/helpers/MultiVaultHelperLiquidity.sol
ethereum/contracts/multivault/interfaces/multivault/IMultiVaultFacetFees.sol
ethereum/contracts/multivault/multivault/facets/MultiVaultFacetDeposit.sol
ethereum/contracts/libraries/SafeMath.sol
ethereum/contracts/multivault/libraries/AddressUpgradeable.sol
everscale/contracts/utils/cell-encoder/DaoCellEncoder.tsol
everscale/contracts/bridge/interfaces/event-contracts/IEthereumEverscaleEvent.tsol
everscale/contracts/utils/Delegate.tsol
everscale/contracts/bridge/event-contracts/base/evm/EthereumEverscaleBaseEvent.tsol
everscale/contracts/bridge/hidden-bridge/EventCloser.tsol
everscale/contracts/bridge/proxy/multivault/alien/V7/ProxyMultivaultAlien_V7_Base.tsol
everscale/contracts/bridge/interfaces/event-configuration-contracts/IEthereumEverscaleEventConfiguration.tsol
ethereum/contracts/multivault/interfaces/multivault/IMultiVaultFacetSettingsEvents.sol
ethereum/contracts/multivault/multivault/facets/DiamondOwnershipFacet.sol
dao/structures/ProposalConfigurationStructure.tsol
everscale/contracts/bridge/interfaces/event-contracts/multivault/evm/IMultiVaultEVMEverscaleEventNative.tsol
everscale/contracts/bridge/interfaces/proxy/IEthereumEverscaleProxy.tsol
everscale/contracts/bridge/event-contracts/multivault/evm/MultiVaultEverscaleEVMEventAlien.tsol
everscale/contracts/bridge/interfaces/event-contracts/multivault/evm/IMultiVaultEverscaleEVMEventNative.tsol
ethereum/contracts/libraries/Array.sol
ethereum/contracts/multivault/interfaces/multivault/IMultiVaultFacetPendingWithdrawalsEvents.sol
everscale/contracts/bridge/proxy/multivault/alien/V7/ProxyMultiVaultAlien_V7_MergePool.tsol
everscale/contracts/bridge/event-contracts/staking/StakingEverscaleEthereumEvent.tsol
everscale/contracts/bridge/event-contracts/staking/StakingEthereumEverscaleEvent.tsol
everscale/contracts/bridge/hidden-bridge/Mediator.tsol
everscale/contracts/staking/base/StakingBase.tsol
ethereum/contracts/multivault/interfaces/IDiamondLoupe.sol
everscale/contracts/staking/interfaces/IRelayRound.tsol
ethereum/contracts/utils/Cache.sol
dao/interfaces/IProposal.tsol
ethereum/contracts/multivault/multivault/helpers/MultiVaultHelperActors.sol
everscale/contracts/bridge/proxy/multivault/native/V5/ProxyMultiVaultNative_V5_Withdraw.tsol
everscale/contracts/bridge/event-contracts/multivault/evm/MultiVaultEverscaleEVMEventNative.tsol
ethereum/contracts/libraries/Math.sol
everscale/contracts/bridge/interfaces/event-contracts/multivault/evm/IMultiVaultEverscaleEVMEventAlien.tsol
dao/interfaces/IProposer.tsol
ethereum/contracts/multivault/multivault/facets/MultiVaultFacetSettings.sol
ethereum/contracts/multivault/interfaces/multivault/IOctusCallback.sol
ethereum/contracts/interfaces/IERC20Metadata.sol
everscale/contracts/staking/interfaces/IUpgradableByRequest.tsol
everscale/contracts/bridge/factory/EverscaleEthereumEventConfigurationFactory.tsol
ethereum/contracts/multivault/utils/Ownable.sol
ethereum/contracts/multivault/multivault/facets/MultiVaultFacetLiquidity.sol
ethereum/contracts/multivault/utils/ChainId.sol
ethereum/contracts/interfaces/IWETH.sol
everscale/contracts/utils/cell-encoder/MediatorCellEncoder.tsol
ethereum/contracts/multivault/multivault/storage/DiamondStorage.sol
ethereum/contracts/multivault/proxy/ProxyAdmin.sol
everscale/contracts/bridge/proxy/multivault/alien/V7/ProxyMultiVaultAlien_V7_Deposit_EVM.tsol
ethereum/contracts/interfaces/IRegistry.sol
ethereum/contracts/multivault/multivault/helpers/MultiVaultHelperTokens.sol
ethereum/contracts/libraries/UniversalERC20.sol
everscale/contracts/bridge/libraries/BurnType.tsol
everscale/contracts/utils/cell-encoder/ProxyMultiVaultCellEncoder.tsol
everscale/contracts/utils/Receiver.tsol
everscale/contracts/utils/cell-encoder/TokenCellEncoder.tsol
ethereum/contracts/bridge/Bridge.sol
everscale/contracts/utils/Platform.tsol
ethereum/contracts/multivault/utils/Context.sol
ethereum/contracts/multivault/Diamond.sol
everscale/contracts/bridge/event-contracts/base/BaseEvent.tsol
everscale/contracts/staking/interfaces/IElection.tsol
ethereum/contracts/multivault/proxy/ERC1967Upgrade.sol
everscale/contracts/bridge/proxy/multivault/native/V5/ProxyMultiVaultNative_V5_Deposit.tsol
everscale/contracts/bridge/interfaces/proxy/multivault/alien/IProxyMultiVaultAlien_V7.tsol
ethereum/contracts/DAO.sol
everscale/contracts/bridge/interfaces/event-contracts/IEverscaleEthereumEvent.tsol
everscale/contracts/staking/Election.tsol
ethereum/contracts/multivault/multivault/helpers/MultiVaultHelperGas.sol
ethereum/contracts/multivault/libraries/Meta.sol
dao/structures/ProposalStates.tsol
ethereum/contracts/libraries/SafeERC20.sol
everscale/contracts/bridge/event-configuration-contracts/evm/EverscaleEthereumEventConfiguration.tsol
everscale/contracts/staking/UserData.tsol
everscale/contracts/bridge/alien-token-merge/MergePoolPlatform.tsol
ethereum/contracts/libraries/Context.sol
ethereum/contracts/multivault/multivault/storage/MultiVaultStorageInitializable.sol
everscale/contracts/bridge/interfaces/alien-token/ITokenRootAlienEVM.tsol
dao/DaoRoot.tsol

Part of Venom Foundation’s security record

Venom Foundation

Audits3 audits by 1 firmLast audit Nov 2023, by Hacken.

Critical findingsNo open critical findingsAcross the 3 reports, 4 critical findings were reported. Each is marked fixed by the firm that reported it.

Open Venom Foundation’s security record

Security firm

Hacken

343 projects reviewed · 476 reports · latest Sep 2026

See Hacken’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.