Axelar Interchain Token Service
Ackee Blockchain Security reviewed Axelar (Axelar Interchain Token Service) on 18 Mar 2024: 23 findings, 2 critical; 18 marked fixed, 3 acknowledged, 2 open.
Report hosted on GitHub.
Trustblock does not review code.
Findings23
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 4 |
| Medium | 2 | 2 | 7 |
| Low | 0 | 1 | 5 |
Marked Warning or Info by the firm. Not counted as findings.
InfoAmbiguous revert messageOpen
The report gives no description here.
WarningCode-comment discrepancyOpen
The report gives no description here.
InfoIncorrect inline documentationOpen
The report gives no description here.
InfoInterchainToken revert if max approval givenOpen
The report gives no description here.
WarningLack of contract prefixes in slot preimagesOpen
The report gives no description here.
WarningLack of eventsOpen
The report gives no description here.
WarningLinkerRouter initial trusted parameters cannot be setOpen
The report gives no description here.
InfoLinkerRouter remote addresses normalizationOpen
The report gives no description here.
WarningManager implementation zero address checkOpen
The report gives no description here.
WarningPossible code injection on deployment on remoteOpen
The report gives no description here.
Show 10 more
InfoToken manager send function namesOpen
The report gives no description here.
InfoUnused functions and variablesOpen
The report gives no description here.
WarningCanonical lock/unlock fee-on-transfer tokensAcknowledged
The report gives no description here.
WarningChain name data validationAcknowledged
The report gives no description here.
WarningChange in the enum order can affect access controlsAcknowledged
The report gives no description here.
WarningDifferent decimals not handledAcknowledged
The report gives no description here.
WarningDuplicated codeAcknowledged
The report gives no description here.
WarningDuplicated codeAcknowledged
The report gives no description here.
InfoInconsistent code styleAcknowledged
The report gives no description here.
InfoInterchainToken has code unrelated to the token logicAcknowledged
The report gives no description here.
Show 10 more
WarningMalicious token registrationAcknowledged
The report gives no description here.
WarningOne-step role transferAcknowledged
The report gives no description here.
WarningPrefix incorrectly calculatedAcknowledged
The report gives no description here.
WarningUnused internal functionsAcknowledged
The report gives no description here.
WarningUsage of solc optimizerAcknowledged
The report gives no description here.
InfoUse type(uint256).max for infinite flow limitAcknowledged
The report gives no description here.
Info_executeWithToken redundant modifierFixed
The report gives no description here.
WarningA danger of the interchain service's balance drainageFixed
The report gives no description here.
InfoCode duplicationFixed
The report gives no description here.
WarningexecuteWithToken and expressExecuteWithToken functions do not check for the correctness of payload argumentsFixed
The report gives no description here.
Show 10 more
WarningExpress receive functions can be called by recipientFixed
The report gives no description here.
WarningHardcoded metadata version/prefixFixed
The report gives no description here.
WarningIdentical function bodyFixed
The report gives no description here.
WarningIInterchainTokenExecutable typoFixed
The report gives no description here.
InfoIInterchainTokenService event parameter typoFixed
The report gives no description here.
InfoIncorrect or missing documentationFixed
The report gives no description here.
WarningIncorrect parent contractFixed
The report gives no description here.
InfoInterchainTokenServiceProxy unused constructor parameterFixed
The report gives no description here.
WarningMisleading TokenManagerNotDeployed error nameFixed
The report gives no description here.
InfoMissing documentationFixed
The report gives no description here.
Show 10 more
InfoMissing documentationFixed
The report gives no description here.
WarningMissing symbol validationFixed
The report gives no description here.
WarningPREFIX_CANONICAL_TOKEN_ID typoFixed
The report gives no description here.
InfoRedundant data validationFixed
The report gives no description here.
InfoReentrancy lock privateFixed
The report gives no description here.
WarningrequiresApproval misleading valueFixed
The report gives no description here.
WarningReturn of literal instead of enumFixed
The report gives no description here.
InfoStringToAddress library unusedFixed
The report gives no description here.
WarningToken id can differ on the deployment methodFixed
The report gives no description here.
WarningToken manager implementations order validationFixed
The report gives no description here.
Show 4 more
InfoTypo in function parameter nameFixed
The report gives no description here.
InfoUnused constantFixed
The report gives no description here.
InfoUnused using-for directivesFixed
The report gives no description here.
WarningZero amount transfers possibleFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Axelar’s security record
AxelarSecurity firm
Ackee Blockchain Security39 projects reviewed · 81 reports · latest Jul 2026
See Ackee Blockchain Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us