SVM Spoke Audit

OpenZeppelinRepository at commit 401e24c

Audit · firm’s term: audit

OpenZeppelin reviewed Across Protocol (SVM Spoke Audit) on 12 May 2025: 12 findings, 0 critical; 3 marked fixed, 5 acknowledged, 4 open.

No open critical findings
Open the reportOpen Across Protocol’s security record

Report hosted on blog.openzeppelin.com.

Trustblock does not review code.

Findings12

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High200
Medium010
Low243
HighExploitation of Cost Asymmetries Across Chains to Impose High Gas Costs on Refund ExecutionOpen

The report gives no description here.

HighForced Use of Claim Accounts for All Relayers in Certain ScenariosOpen

The report gives no description here.

LowInefficient PDA Derivation in handle_v3_across_messageOpen

The report gives no description here.

LowMissing SpeedUpV3Deposit and FillV3RelayWithUpdatedDeposit Functionalities in SVM Spoke PoolOpen

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (36)

  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/constants.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/error.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/test/src/lib.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/refund_claims.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/create_token_accounts.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/multicall-handler/src/lib.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/state.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/route.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/utils/message_utils.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/bundle.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/utils/cctp_utils.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/mod.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/deposit.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/utils/mod.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/constraints.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/handle_receive_message.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/slow_fill.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/common/v3_relay_data.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/admin.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/common/mod.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/contracts/chain-adapters/Solana_Adapter.sol at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/utils/deposit_utils.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/utils/transfer_utils.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/root_bundle.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/utils/bitmap_utils.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/refund_account.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/utils/merkle_proof_utils.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/instruction_params.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/event.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/lib.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/instruction_params.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/fill.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/mod.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/token_bridge.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/transfer_liability.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/fill.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6

Part of Across Protocol’s security record

Across Protocol
Audits15 audits by 1 firmLast audit May 2025, by OpenZeppelin.
Critical findingsNo open critical findingsAcross the 15 reports, 4 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Across Protocol’s security record

Security firm

OpenZeppelin

67 projects reviewed · 184 reports · latest Aug 2026

See OpenZeppelin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us