bitcorn-oft
Cantina reviewed Bitcorn (bitcorn-oft) on 14 Dec 2024: 25 findings, 1 critical; 21 marked fixed, 4 acknowledged.
Report hosted on cantina.xyz.
Trustblock does not review code.
Findings25
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 1 | 0 |
| Medium | 0 | 0 | 4 |
| Low | 0 | 3 | 16 |
CriticalManipulated sendParam in swapExactCollateralForDebtAndLZSend function allows unauthorized token mintingFixed
The report gives no description here.
MediumInaccessible pause mechanism in WrappedBitcornNativeOFTAdapterFixed
The report gives no description here.
MediumInconsistent native fee validation leading to transaction failuresFixed
The report gives no description here.
MediumSwapFacility.swapExactCollateralForDebt() calls by unvigilant users may be owner frontrunnable for value capture via feesFixed
The report gives no description here.
MediumUncollected fees may be irrevocably burnt when calling SwapFacility.setMintCap() to be below feeFixed
The report gives no description here.
LowAvoid tightly packed variables as initial declarations in upgradeable contractFixed
The report gives no description here.
LowCache state variables with multiple accesses within a scopeFixed
The report gives no description here.
LowCalls to SwapFacility._calcFee() with _feeRate of 0 will revert, but should be handledFixed
The report gives no description here.
LowConsider removing whenNotPaused on permissioned functions, to aid in maintenance scenariosFixed
The report gives no description here.
LowERC20Pausable is initialized twice in WrappedBitcornNativeOFTAdapterFixed
The report gives no description here.
Show 10 more
LowFunction sharedDecimals incorrectly marked as view instead of pureFixed
The report gives no description here.
LowIncorrect LayerZero token fee handlingFixed
The report gives no description here.
LowIncorrect pause implementation results in confusing error messages in BitcornOFTFixed
The report gives no description here.
LowMinor code quality issues: typosFixed
The report gives no description here.
LowRedundant fee initialization in _swapExactCollateralForDebt functionFixed
The report gives no description here.
LowRemove unused _delegate parameter from BitcornOFT constructorFixed
The report gives no description here.
LowRemove unused file importsFixed
The report gives no description here.
LowRestrict visibility specifier to lowest necessary visibilityFixed
The report gives no description here.
LowSwapFacility token buffer may be exhausted if collectFees() is frontrun by sufficient donation, leading to remediable DoSFixed
The report gives no description here.
LowSwapInFeeRate and SwapOutFeeRate are applied differentlyFixed
The report gives no description here.
Show 1 more
LowUtilize SafeERC20.safeTransferFrom() when interacting with 3rd-party tokensFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Bitcorn’s security record
Security firm
Cantina37 projects reviewed · 175 reports · latest Oct 2026
See Cantina’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us