Securitize Bridge ACL Ext Audit Report

CyfrinCode version: not recorded (see the report)

Cyfrin reviewed Securitize (Securitize Bridge ACL Ext Audit Report) on 30 Jul 2026: 4 findings, 0 critical; 3 marked fixed, 1 acknowledged.

No open critical findings
Open the reportOpen Securitize’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low013

Marked Informational or Gas by the firm. Not counted as findings.

InformationalMissing upfront validation during initializationAcknowledged

The report gives no description here.

InformationalWhitelist pause does not stop investor registry create/delete pathsAcknowledged

The report gives no description here.

InformationalEmpty investor_id can be persisted in InvestorRegistry and propagated through the SPL bridgeFixed

The report gives no description here.

InformationalInconsistent investor_id length limits across layers (64 vs 256) and an undocumented 32-byte PDA-seed constraint on the DS pathFixed

The report gives no description here.

InformationalOutbound DS/SPL bridge handlers do not validate EVM recipient address formatFixed

The report gives no description here.

GasRedundant heap clone of the up-to-1024-byte VAA payload on every inbound bridge transactionFixed

The report gives no description here.

Informationalsecuritize_bridge inbound SPL resolver hardcodes the Token-2022 program for ATA derivation, breaking inbound delivery for a classic-SPL-Token mint configured as TokenConfig::SplFixed

The report gives no description here.

Informationaltracker_account binding is not validated upfront in bridge_ds_tokensFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Securitize’s security record

Securitize
Audits37 audits by 2 firmsLast audit Sep 2026, by Cyfrin.
Critical findingsNo open critical findingsAcross the 37 reports, 6 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Securitize’s security record

Security firm

Cyfrin

28 projects reviewed · 79 reports · latest Sep 2026

See Cyfrin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us