Axelar Interchain Token Service
Ackee Blockchain Security reviewed Axelar (Axelar Interchain Token Service) on 18 Mar 2024: 23 findings, 2 critical; 18 marked fixed, 3 acknowledged, 2 open.
Report hosted on GitHub.
Trustblock does not review code.
Findings23
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 4 |
| Medium | 2 | 2 | 7 |
| Low | 0 | 1 | 5 |
CriticalMint privilegeFixed
The report gives no description here.
CriticalThe executeWithToken function may be called by anyoneFixed
The report gives no description here.
HighexecuteWithToken allows to perform interchain operations even when the protocol is pausedFixed
The report gives no description here.
HighExpress receive double executionFixed
The report gives no description here.
HighTokens with callbacks can artificially increase cross-chain transfer amountFixed
The report gives no description here.
HighWrong variable passed to hookFixed
The report gives no description here.
MediumERC-20 double approvalFixed
The report gives no description here.
MediumFront-running express execute with copy of gateway payloadFixed
The report gives no description here.
MediumGateway token check missingFixed
The report gives no description here.
MediumOperator slot incorrect preimageFixed
The report gives no description here.
Show 8 more
MediumProposed role not cleared when acceptedFixed
The report gives no description here.
MediumtoAddress missing validationFixed
The report gives no description here.
MediumTokens with callbacks can artificially increase cross-chain transfer amountFixed
The report gives no description here.
LowChain name validationFixed
The report gives no description here.
LowexpressReceiveTokenWithData spoofed dataFixed
The report gives no description here.
LowMissing validationsFixed
The report gives no description here.
LowMissing validationsFixed
The report gives no description here.
LowsendHash is not uniqueFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Axelar’s security record
AxelarSecurity firm
Ackee Blockchain Security39 projects reviewed · 81 reports · latest Jul 2026
See Ackee Blockchain Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us