Spicenet security review
Audit · firm’s term: security review
Pashov Audit Group reviewed Spicenet (Spicenet security review) on 10 Apr 2026: 15 findings, 0 critical; 11 marked fixed, 4 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings15
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 4 | 6 |
HighInconsistent token decimal handling in update_mapping functionFixed
The report gives no description here.
HighMissing recipient validation in process_transaction functionFixed
The report gives no description here.
MediumFailed withdrawals have no recovery path permanently locking user valuesFixed
The report gives no description here.
MediumWithdrawal confirmation burns amounts without validating against stored requestFixed
The report gives no description here.
MediumWithdrawal confirmation lacks validation of chain_hash against stored requestFixed
The report gives no description here.
LowAdmin address is immutable no key rotation mechanismFixed
The report gives no description here.
LowInconsistent HashSet implementations across the crateFixed
The report gives no description here.
LowNo validation of log.address in WithdrawalProcessed event enables attackFixed
The report gives no description here.
LowOnly the first call in a signed batch is executed while others are discardedFixed
The report gives no description here.
LowSmart contract wallets unable to withdraw funds from L1 escrowFixed
The report gives no description here.
Show 1 more
LowWithdrawal requests persist unbounded user- controlled stringsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Spicenet’s security record
SpicenetSecurity firm
Pashov Audit Group86 projects reviewed · 165 reports · latest Aug 2026
See Pashov Audit Group’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us