Datachain - App for Liquidity

Quantstamp27 Jan 2025Repository at commit dcccb98

Quantstamp reviewed Datachain (Datachain - App for Liquidity) on 27 Jan 2025: 20 findings, 0 critical; 15 marked fixed, 4 acknowledged, 1 open.

No open critical findings

Open the report Open Datachain’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings20

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	2
Medium	1	1	3
Low	0	3	10

MediumUnvalidated External Payloads and Lack of Dynamic Gas Cost Adjustment Lead to Unpredictable Cross-Chain Transaction OutcomesOpen

The TOKI protocol's cross-chain functionality allows users to include arbitrary data in the `to` parameter and `ExternalInfo.payload` field when initiating transactions like `transferPool()`, `transferToken()`, `withdrawRemote()`, and `withdrawLocal()` in `Bridge.sol`. This data is intended for callbacks on the destination chain via the `ITokiOuterServiceReceiver(to).onReceivePool()` call in `_outServiceCallCore`. However, this mechanism presents significant problems: 1. **Unvalidated and Unrestricted Input:** The protocol does not sufficiently validate or restrict the data provided in the `to` parameter or `ExternalInfo.payload`. This lack of sanitization means that the data sent across chains might not fall within the capabilities of the destination chain in terms of block size, gas usage, and other properties. This can lead to unexpected results, failed transactions, and potentially locked tokens on the destination chain. Although the protocol adopts fallback and retry mechanisms, these are not always sufficient to handle such scenarios. 2. **Inaccurate Gas Cost Estimation:** The `RelayerFeeCalculator` contract uses a fixed `premiumBPS` along with oracle-derived prices to estimate relayer fees. This approach fails to accurately account for the dynamic and unpredictable gas costs associated with executing arbitrary code in the user-provided callbacks. The fixed premium is unlikely to be sufficient to cover the actual gas costs, especially if users intentionally or unintentionally provide expensive callbacks. 3. **The `try...catch` Block Fails to Catch Out-of-Gas Exceptions**: If a transaction depletes all of its gas in an external call within a `try` statement, there will not be enough gas remaining to catch out-of-gas exceptions or to execute the `catch` block. The Toki protocol, however, relies on catching exceptions on the destination side of intra-blockchain communications to capture failed calls and append them to the retry queue. This can result in cases where an external call within a `try` block on the destination side runs out of gas without leaving any trace in the protocol, since the transaction has failed.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (47)

https://github.com/datachainlab/toki-bridge-evm-contracts/src/Bridge.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IDecimalConvertible.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IBridgeQuerier.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IETHVault.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/library/MessageType.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/BridgeQuerier.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/BridgeFallback.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IRelayerFeeCalculator.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/handler/OwnableIBCHandlerUpgradeable.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/IBCChannelUpgradableModuleBase.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/library/IBCUtils.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/ITransferPoolFeeCalculator.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/BridgeBase.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/ITokiErrors.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/yui.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/StaticFlowRateLimiter.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IETHBridge.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IStaticFlowRateLimiter.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IBridgeRouter.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/DecimalConvertibleUpgradeable.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IBridgeManager.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IAppVersion.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/BridgeChannelUpgradeFallback.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IPoolRepository.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IStableTokenPriceOracle.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/BridgeManager.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/GasPriceOracle.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IChainlinkPriceFeed.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IGasPriceOracle.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/clients/LCPClientUpgradeable.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/clients/RecoveredLCPClientUpgradeable.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/Pool.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/ETHBridge.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/ITokiOuterServiceReceiver.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/StableTokenPriceOracle.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/PoolRepository.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/TokenPriceOracle.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/VersionStringValidator.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IReceiveRetryable.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/replaceable/RelayerFeeCalculator.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/ITokenPriceOracle.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/replaceable/TransferPoolFeeCalculator.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IBridge.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IReceiveRetryableSelf.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/interfaces/IPool.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/ETHVault.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257
https://github.com/datachainlab/toki-bridge-evm-contracts/src/BridgeStore.sol at commit dcccb98ee4edf58a7956cc9c7cc804969b407257

Part of Datachain’s security record

Datachain

Audits7 audits by 1 firmLast audit Jul 2025, by Quantstamp.

Critical findingsNo open critical findingsAcross 7 reports.

Open Datachain’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us