Router Chain 2 audit
Oak Security reviewed Router Protocol (Router Chain 2 audit) on 30 Apr 2024: 27 findings, 7 critical; 26 marked fixed, 1 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings27
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 7 |
| High | 0 | 0 | 11 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 1 | 8 |
CriticalAnyone can submit forged cross-chain ack requestsFixed
The report gives no description here.
CriticalAnyone can submit forged cross-chain requestsFixed
The report gives no description here.
CriticalBlocked cross-chain requests are indefinitely retried and could be exploited for denial-of-service attacksFixed
The report gives no description here.
CriticalDeactivated price feeders are not enforcedFixed
The report gives no description here.
CriticalNon-deterministic iteration in ClaimEventSlashing can cause consensus failureFixed
The report gives no description here.
CriticalUnapproved fee payers can block legitimate requests which can be exploited for denial-of-service attacksFixed
The report gives no description here.
CriticalUnbonding validators can circumvent slashingFixed
The report gives no description here.
HighAnyone can create a new relayer configuration with a potentially invalid IBC channel, resulting in failed cross-chain requests via IBCFixed
The report gives no description here.
HighCustom application panics in EndBlocker can halt the chainFixed
The report gives no description here.
HighExecuting crosstalk requests with a missing IBC relayer config results in indefinite retries and liveness issuesFixed
The report gives no description here.
Show 10 more
HighFailed cross-chain ack requests are incorrectly stored as successfulFixed
The report gives no description here.
HighFailed requests will not be reflected for ErrorGasOverflow panicsFixed
The report gives no description here.
HighGetLastUnBondingBlockHeight will always return zeroFixed
The report gives no description here.
HighIncomplete genesis handling causes loss of storage valuesFixed
The report gives no description here.
HighSlashing risk due to sequential attestation processingFixed
The report gives no description here.
HighSymbol prices requested by the BandChain oracle are not namespaced by the price feeder name, resulting in the inability to retrieve pricesFixed
The report gives no description here.
HighUnhandled errors in the codebaseFixed
The report gives no description here.
HighZero values initialization affects gas handling and fee refundsFixed
The report gives no description here.
LowAmino codec must be registered to support end users with hardware devices like LedgerFixed
The report gives no description here.
LowErrors are not propagated correctlyFixed
The report gives no description here.
Show 6 more
Lowgas-prices and token-prices CLI commands are ineffective due to not specifying the PriceFeederName and corresponding pricesFixed
The report gives no description here.
LowHandleAckDefaultValidation does not update the event block height, causing incorrect query responses to be returnedFixed
The report gives no description here.
LowPrice feeders can feed prices with older resolve timesFixed
The report gives no description here.
Lowrwasm module does not support InstantiateContract2, UpdateAdmin, and ClearAdminFixed
The report gives no description here.
LowThe execute-cw-contract CLI command does not supply Msg and Funds to the MsgExecuteContract messageFixed
The report gives no description here.
LowValidators joining the network after attestations were submitted are subject to slashing and have to attest to previous claimsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Router Protocol’s security record
Router ProtocolSecurity firm
Oak Security33 projects reviewed · 60 reports · latest May 2026
See Oak Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us