Securitize Bridge CCTPv2 Audit Report
Audit · firm’s term: audit report
Part of Cyfrin’s series
Cyfrin reviewed Securitize (Securitize Bridge CCTPv2 Audit Report) on 7 Oct 2025: 8 findings, 0 critical; 5 marked fixed, 3 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings8
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 1 | 3 |
| Low | 0 | 2 | 2 |
Marked Gas or Informational by the firm. Not counted as findings.
GasCache storage to prevent identical storage readsAcknowledged
The report gives no description here.
InformationalMisleading event emission in USDCBridgeV2::addBridgeCaller, removeBridgeCaller when role was not granted or revokedAcknowledged
The report gives no description here.
GasPass _refundChain as input to USDCBridgeV2::_buildCCTPKey saves 1 storage read and external callAcknowledged
The report gives no description here.
InformationalPending/re-executable messages sourced from old bridge addresses will not be executable if bridge address is updatedAcknowledged
The report gives no description here.
InformationalPrefer Ownable2StepUpgradeable instead of OwnableUpgradeable in BaseContractAcknowledged
The report gives no description here.
GasRemove unused return from USDCBridgeV2:_sendUSDCWithPayloadTo- EvmAcknowledged
The report gives no description here.
InformationalRename SecuritizeBridge::whChainId to whRefundChainIdAcknowledged
The report gives no description here.
InformationalUninitialized country for valid investor wallets allows bypassing US compliance lockup periodAcknowledged
The report gives no description here.
InformationalUSDCBridgeV2 can’t bridge to non-EVM chains even though Wormhole and Circle CCTP support thisAcknowledged
The report gives no description here.
GasUse named return values where this can eliminate local variablesAcknowledged
The report gives no description here.
Show 10 more
GasUse ReentrancyGuardTransientUpgradeable for faster nonReentrant modifiersAcknowledged
The report gives no description here.
InformationalEmit missing events on important parameter changesFixed
The report gives no description here.
GasFail fast without doing unnecessary workFixed
The report gives no description here.
InformationalFollow function declaration solidity style guide in BaseContractFixed
The report gives no description here.
GasRefactor SecuritizeBridge::bridgeDSTokens and quoteBridge to use internal function saves 2 storage reads per bridging transactionFixed
The report gives no description here.
GasRefactor SecuritizeBridge::validateLockedTokens to take dsServiceConsumer as input parameterFixed
The report gives no description here.
InformationalRemove unused function USDCBridgeV2::_redeemUSDCFixed
The report gives no description here.
InformationalRemove unused importsFixed
The report gives no description here.
InformationalUpgradeable contracts should call _disableInitializers in constructorFixed
The report gives no description here.
InformationalUse addressNotZero modifier on USDCBridgeV2::setBridgeAddressFixed
The report gives no description here.
Show 4 more
InformationalUse named importsFixed
The report gives no description here.
InformationalUse named mapping parameters to make explicit the purpose of keys and valuesFixed
The report gives no description here.
InformationalUse SafeERC20 approval and transfer functions instead of standard IERC20 functionsFixed
The report gives no description here.
GasUse targetAddress instead of bridgeAddresses[targetChain] for check in SecuritizeBridge::bridgeDSTokensFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Securitize’s security record
SecuritizeSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us