Securitize EVM GlobalDenyList Audit Report

Cyfrin11 Sep 2026Code version: not recorded (see the report)

Cyfrin reviewed Securitize (Securitize EVM GlobalDenyList Audit Report) on 11 Sep 2026: 4 findings, 0 critical; 2 marked fixed, 2 acknowledged.

No open critical findings

Open the report Open Securitize’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	0	2	2

Marked Informational or Gas by the firm. Not counted as findings.

InformationalServiceConsumer::setDSService accepts an address with no code, halting all transfers and issuance on the wired tokenOpen

The report gives no description here.

InformationalComplianceService::validateSeize screens the seize destination only for special-wallet status, so a globally denylisted special wallet can still receive seized tokensAcknowledged

The report gives no description here.

GasCache identical storage reads in ComplianceServicePermissionless::_isGloballyDenylisted, _isLocallyBlacklistedFixed

The report gives no description here.

InformationalDenylist mutators always return true, discarding the EnumerableSet resultFixed

The report gives no description here.

InformationalDeploy task implicit GlobalDenyListManager::initialize resolution can silently deploy an uninitialized proxyFixed

The report gives no description here.

Informationaldeploy-all does not await GlobalDenyListManager::addOperator, changeAdmin receipts and reports success on unconfirmed transactionsFixed

The report gives no description here.

Informationaldeploy-all treats a zero –global-denylist-manager-address as wired, logging success while leaving global denylist enforcement offFixed

The report gives no description here.

InformationalGlobalDenyListManager::revokeOperator is bypassable via inherited AccessControlUpgradeable::revokeRole, renounceRole, which emit no OperatorRevokedFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Securitize’s security record

Securitize

Audits37 audits by 2 firmsLast audit Sep 2026, by Cyfrin.

Critical findingsNo open critical findingsAcross the 37 reports, 6 critical findings were reported. Each is marked fixed by the firm that reported it.

Open Securitize’s security record

Security firm

Cyfrin

28 projects reviewed · 79 reports · latest Sep 2026

See Cyfrin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.