Securitize Bridge CCTPv2 Audit Report

Cyfrin7 Oct 2025Code version: not recorded (see the report)

Audit · firm’s term: audit report

Part of Cyfrin’s series

Cyfrin reviewed Securitize (Securitize Bridge CCTPv2 Audit Report) on 7 Oct 2025: 8 findings, 0 critical; 5 marked fixed, 3 acknowledged.

No open critical findings

Open the report Open Securitize’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	1	3
Low	0	2	2

MediumBridging DSToken back-and-forth between chains causes totalIssuance cap to be reached, preventing further issuances and cross-chain transfersFixed

The report gives no description here.

MediumHard-coding 0 max fee with fast finality is incompatible as this combination commonly has minimum fees of 1Fixed

The report gives no description here.

MediumUninitialized CCTP domain mapping can send USDC to the incorrect blockchainFixed

The report gives no description here.

LowDon’t use transfer to send ETHFixed

The report gives no description here.

LowNo way to retrieve ETH sent with call to Securitize- Bridge::receiveWormholeMessagesFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Securitize’s security record

Securitize

Audits37 audits by 2 firmsLast audit Sep 2026, by Cyfrin.

Critical findingsNo open critical findingsAcross the 37 reports, 6 critical findings were reported. Each is marked fixed by the firm that reported it.

Open Securitize’s security record

Security firm

Cyfrin

28 projects reviewed · 79 reports · latest Sep 2026

See Cyfrin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.