Hyperlane security review

Cairo Security ClanFiles named in the report

Audit · firm’s term: security review

Cairo Security Clan reviewed Hyperlane (Hyperlane security review) on 11 Aug 2024: 14 findings, 3 critical; 13 marked fixed, 1 open.

3 critical findings, fixed
Open the reportOpen Hyperlane’s security record
Report stored on IPFS. Content hash bafybeie3ibbvzw2wjinhpuq5dfd5impqo47frh4hjd56smwcvu3aa752fu

Trustblock does not review code.

Findings14

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical003
High004
Medium100
Low006
Criticalhyp_native and hyp_native_scaled components malfunctionFixed

In starknet there is no native token like in EVM; all tokens are represented as smart contracts such as eth and strk. The hyp_native component is intended to manage the transfer of native tokens (eth). The _transfer_to function mistakenly uses the contract address of hyp_native instead of the intended erc20 token address. Additionally, _transfer_from_sender and transfer_from_sender_hook lack implementation to retrieve tokens from users.

Criticalmissing access control check in function handleFixed

The report gives no description here.

Criticalpublic _dispatch function allows users to bridge tokens without locking or burning on source chainFixed

The report gives no description here.

Highincorrect token recipient in function _get_token_recipient of fasttokenrouter componentFixed

The report gives no description here.

Highmailbox eth fee not transferred by users when calling mailbox.dispatchFixed

The report gives no description here.

Highmissing logic in function transfer_to_hook of hyperc721uricollateralFixed

The report gives no description here.

Highusers can use the transfer_remote function without scaling in hyp_native_scaledFixed

The report gives no description here.

Lowconstructor of contract hyperc721 does not call erc721_enumerable.initializerFixed

The report gives no description here.

Lowduplicate definition of wrapped_token in hyp_erc721_collateralFixed

The report gives no description here.

Lowhyp_native and hyp_native_scaled contract should not implement erc20componentFixed

The report gives no description here.

Show 3 more
Lowunchecked return values of erc20 transferFixed

The report gives no description here.

Lowunused storage variable gas_routerFixed

The report gives no description here.

Lowunused storage variables in hyp_erc721_uri_collateralFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (36)

  • src/components/erc721_uri_storage.cairo
  • src/extensions/hyp_xerc20.cairo
  • src/extensions/hyp_erc721_uri_collateral.cairo
  • src/components/hyp_erc721_collateral_component.cairo
  • src/components/hyp_native_component.cairo
  • src/interfaces/imessage_recipient.cairo
  • src/extensions/fast_hyp_erc20_collateral.cairo
  • src/libs/math.cairo
  • src/interfaces/ifiat_token.cairo
  • src/extensions/fast_hyp_erc20.cairo
  • src/extensions/hyp_xerc20_lockbox.cairo
  • src/components/hyp_erc721_component.cairo
  • src/components/fast_token_router.cairo
  • src/hyp_erc20.cairo
  • src/client/gas_router_component.cairo
  • src/hyp_native.cairo
  • src/extensions/hyp_fiat_token.cairo
  • src/extensions/hyp_erc20_vault.cairo
  • src/libs/enumerable_map.cairo
  • src/lib.cairo
  • src/interfaces/ierc4626.cairo
  • src/interfaces/ixerc20_lockbox.cairo
  • src/client/router_component.cairo
  • src/components/token_router.cairo
  • src/hyp_erc721_collateral.cairo
  • src/hyp_erc20_collateral.cairo
  • src/extensions/hyp_erc20_vault_collateral.cairo
  • src/extensions/hyp_erc20_collateral_vault_deposit.cairo
  • src/hyp_erc721.cairo
  • src/extensions/hyp_erc721_uri_storage.cairo
  • src/components/erc721_enumerable.cairo
  • src/components/hyp_erc20_collateral_component.cairo
  • src/components/token_message.cairo
  • src/extensions/hyp_native_scaled.cairo
  • src/interfaces/ixerc20.cairo
  • src/components/hyp_erc20_component.cairo

Part of Hyperlane’s security record

Hyperlane
Audits3 audits by 2 firmsLast audit Sep 2025, by Cairo Security Clan.
Critical findingsNo open critical findingsAcross the 3 reports, 3 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Hyperlane’s security record

Security firm

Cairo Security Clan

13 projects reviewed · 21 reports · latest Sep 2025

See Cairo Security Clan’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us