Securitize SVM VaultRegistrar SPL ACL Audit

Cyfrin17 Sep 2026Code version: not recorded (see the report)

Cyfrin reviewed Securitize (Securitize SVM VaultRegistrar SPL ACL Audit) on 17 Sep 2026: 5 findings, 0 critical; 4 marked fixed, 1 acknowledged.

No open critical findings

Open the report Open Securitize’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	0	1	4

Marked Gas or Informational by the firm. Not counted as findings.

GasCache repeated access_control_authority_pda and mint_config_pda derivations to cut redundant hashing in the SPL register and thaw flowFixed

The report gives no description here.

InformationalOperators can thaw a frozen vault ATA through register_vault_spl under extreme casesFixed

The report gives no description here.

InformationalPermissionless initialize derives the registrar state and authority PDAs from a shared monotonic counter, letting any caller front-run and invalidate pre-signed setup transactionsFixed

The report gives no description here.

InformationalSPL investor token account is not explicitly restricted to Token-2022Fixed

The report gives no description here.

Informationalthaw_vault_token_account_spl unconditionally CPIs ACL thaw_account and reverts on an already-thawed vault token account, unlike the guarded register_vault_spl pathFixed

The report gives no description here.

InformationalVaultRegisteredDs can report a signer unrelated to the attached identityFixed

The report gives no description here.

InformationalVaultRegistrarInitialized omits the initial require_investor_signature valueFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Securitize’s security record

Securitize

Audits37 audits by 2 firmsLast audit Sep 2026, by Cyfrin.

Critical findingsNo open critical findingsAcross the 37 reports, 6 critical findings were reported. Each is marked fixed by the firm that reported it.

Open Securitize’s security record

Security firm

Cyfrin

28 projects reviewed · 79 reports · latest Sep 2026

See Cyfrin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.