Zircuit Finance - Circle CCTP Adapter

Quantstamp29 Apr 2026Code version: not recorded (see the report)

Quantstamp reviewed Zircuit (Zircuit Finance - Circle CCTP Adapter) on 29 Apr 2026: 4 findings, 0 critical; 3 marked fixed, 1 acknowledged.

No open critical findings

Open the report Open Zircuit’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	0
Medium	0	0
Low	1	3

Low`maxFeeBps` Has No Hard Compile-Time Ceiling, Unlike the Rest of the Adapter SuiteAcknowledged

`_setMaxFeeBps()` only checks `bps > BPS_DENOMINATOR` (100,000), meaning `SETTER_ROLE` can configure `maxFeeBps` up to 100%, which would allow callers to submit `maxFee` values up to the full transfer amount. While Circle's current protocol fee is capped at 0–14 bps and a caller still chooses their own `maxFee` in `extraData`, the contract-level guard is supposed to be a ceiling on how large that chosen value can be. The parallel `OFTBridgeAdapter` contract in this same package enforces a hard constant `MAX_ALLOWED_FEE_BPS = 100` (1%) that cannot be raised by any admin action — providing a meaningful protocol-level guarantee.