Datachain - ELC for Bridge - Ethereum

QuantstampRepository at commit 7a40e6a

Quantstamp reviewed Datachain (Datachain - ELC for Bridge - Ethereum) on 8 Jan 2025: 4 findings, 0 critical; 3 marked fixed, 1 acknowledged.

No open critical findings
Open the reportOpen Datachain’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low013
Low`Fraction` Instances Can Have Invalid RatiosFixed

The `Fraction` struct consists of a `numerator` and a `denominator` and it doesn't currently perform any validation of the values when a new instance is created. The following fractions can be created without errors: - A fraction whose `numerator` is greater than its `denominator`; - A fraction whose `denominator` is zero. While it is in principle possible for a mathematical fraction to have a numerator that is greater than its denominator, such instances do not appear to fit the intended use case, i.e. representing the `trust_level` field in a `ClientState` instance.

LowInconsistent State Id Generation Due to Unreset `frozen_height`Fixed

When canonicalizing the `ClientState` to generate a consistent `StateID`, the code resets `latest_execution_block_number` to zero. However, if `frozen_height` is set (i.e., not `None`), it remains unchanged. This can lead to different state IDs when they should be identical, causing unexpected inconsistencies in downstream logic that rely on stable identifiers.

LowNot Taking Update's Next Sync CommitteeFixed

The function `apply_updates()` is designed to mirror the function of the spec named `apply_light_client_update()`. In the latter function, when the stored consensus state lacks a next sync committee, it is checked that the update's finalized header's sync committee period is equal to the stored consensus state's sync committee period, and the update's next sync committee is added to the stored consensus state. However, this assignment does not take place at any point in `apply_updates()`. However, this appears not to be a problematic issue as it appears that the stored consensus state will never be lacking a next sync committee. This is despite the fact that when the new consensus state is validated in `ConsensusState::validate()`, it is not checked whether there is a next sync committee.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (4)

  • https://github.com/datachainlab/ethereum-elc/src/errors.rs at commit 7a40e6a73b1fc08874aa33b7fa4c07daad9141af
  • https://github.com/datachainlab/ethereum-elc/src/lib.rs at commit 7a40e6a73b1fc08874aa33b7fa4c07daad9141af
  • https://github.com/datachainlab/ethereum-elc/src/client.rs at commit 7a40e6a73b1fc08874aa33b7fa4c07daad9141af
  • https://github.com/datachainlab/ethereum-elc/src/state.rs at commit 7a40e6a73b1fc08874aa33b7fa4c07daad9141af

Part of Datachain’s security record

Datachain
Audits7 audits by 1 firmLast audit Jul 2025, by Quantstamp.
Critical findingsNo open critical findingsAcross 7 reports.
Open Datachain’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us