SVM Spoke Audit

OpenZeppelinRepository at commit 401e24c

Audit · firm’s term: audit

OpenZeppelin reviewed Across Protocol (SVM Spoke Audit) on 12 May 2025: 12 findings, 0 critical; 3 marked fixed, 5 acknowledged, 4 open.

No open critical findings
Open the reportOpen Across Protocol’s security record

Report hosted on blog.openzeppelin.com.

Trustblock does not review code.

Findings12

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High200
Medium010
Low243
MediumOveruse of emit_cpi! Macro for Event LoggingAcknowledged

The report gives no description here.

LowEvents Emitted Without State ChangeAcknowledged

The report gives no description here.

LowInconsistent Route Enabling ValidationAcknowledged

The report gives no description here.

LowMishandling of Exclusivity Deadline Greater Than 1 YearAcknowledged

The report gives no description here.

LowPausing Mechanism May Be Slow in Emergency ScenariosAcknowledged

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (36)

  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/constants.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/error.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/test/src/lib.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/refund_claims.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/create_token_accounts.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/multicall-handler/src/lib.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/state.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/route.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/utils/message_utils.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/bundle.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/utils/cctp_utils.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/mod.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/deposit.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/utils/mod.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/constraints.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/handle_receive_message.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/slow_fill.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/common/v3_relay_data.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/admin.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/common/mod.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/contracts/chain-adapters/Solana_Adapter.sol at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/utils/deposit_utils.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/utils/transfer_utils.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/root_bundle.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/utils/bitmap_utils.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/refund_account.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/utils/merkle_proof_utils.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/instruction_params.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/event.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/lib.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/instruction_params.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/fill.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/mod.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/instructions/token_bridge.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/transfer_liability.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6
  • https://github.com/across-protocol/contracts/programs/svm-spoke/src/state/fill.rs at commit 401e24ccca1b3af919dd521e58acd445297b65b6

Part of Across Protocol’s security record

Across Protocol
Audits15 audits by 1 firmLast audit May 2025, by OpenZeppelin.
Critical findingsNo open critical findingsAcross the 15 reports, 4 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Across Protocol’s security record

Security firm

OpenZeppelin

67 projects reviewed · 184 reports · latest Aug 2026

See OpenZeppelin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us