Liquidium Cross-Chain Lending
Audit · firm’s term: Security Assessment
Trail of Bits reviewed Liquidium (Liquidium Cross-Chain Lending) on 14 Nov 2025: 17 findings, 0 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings25
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 4 |
| Medium | 0 | 0 | 8 |
| Low | 0 | 0 | 5 |
HighBorrow checks do not account for pending borrowsFixed
The report gives no description here.
HighImproper BTC withdrawal status checking may allow double spends and lost fundsFixed
The report gives no description here.
HighInterest calculations allow pool funds to be drainedFixed
The report gives no description here.
HighLack of authorization check in withdraw and add_account methodsFixed
The report gives no description here.
MediumBTC deposits can be front-runFixed
The report gives no description here.
MediumHigh transaction volume can cause deposits to be droppedFixed
The report gives no description here.
MediumLiquidation rollback can failFixed
The report gives no description here.
MediumLiquidator funds become stuck when min_collateral_amount cannot be satisfiedFixed
The report gives no description here.
MediumRepayment interest waiver calculations violate invariantsFixed
The report gives no description here.
MediumStale prices cannot be updatedFixed
The report gives no description here.
Show 7 more
MediumUser funds could be trapped due to timeout raceFixed
The report gives no description here.
MediumWithdrawal rollback may fail if all funds are withdrawnFixed
The report gives no description here.
LowFailed borrow produces WithdrawalFailed notificationFixed
The report gives no description here.
LowLiquidation search time grows quadratically with total number of usersFixed
The report gives no description here.
LowProtocol fees can be claimed only onceFixed
The report gives no description here.
LowProtocol reports incorrect outflow status on borrow failureFixed
The report gives no description here.
LowRemoval of an account iterates over all accountsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Liquidium’s security record
LiquidiumSecurity firm
Trail of Bits29 projects reviewed · 47 reports · latest Sep 2026
See Trail of Bits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us