Push Chain / SVM Gateway
Hacken reviewed Push Chain (Push Chain / SVM Gateway) on 24 Apr 2026: 20 findings, 0 critical; 16 marked fixed, 2 acknowledged, 2 open.
Report hosted on hacken.io.
Trustblock does not review code.
Findings20
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 1 | 1 | 5 |
| Low | 1 | 1 | 11 |
Medium[Dual Defense] Missing Post-CPI Validation Allows a Destination Program to Persist Authority Mutations on the CEA and Its ATAFixed
The report gives no description here.
MediumInconsistent Pause Constraints Across Admin FunctionsFixed
The report gives no description here.
MediumInsufficient Privilege Separation in PauseAction Allows Pauser to Unpause the GatewayFixed
The report gives no description here.
MediumMissing Canonical ATA Enforcement on Vault Token Accounts Causes SPL Liquidity FragmentationFixed
The report gives no description here.
MediumUnsigned revert_msg Allows Forged Revert Data in Cross-Chain EventsFixed
The report gives no description here.
LowDead Code in send_tx_with_gas_route Zero-Amount GuardFixed
The report gives no description here.
LowExcessive Pyth Oracle Staleness Window Enables Rate Limit BypassFixed
The report gives no description here.
LowLack of Two-Step Admin TransferFixed
The report gives no description here.
Lowlimit_threshold = 0 Causes Token-Level DoS Instead of Disabling Rate LimitingFixed
The report gives no description here.
LowMissing Mint Authority Validation in set_token_rate_limit Allows Whitelisting Tokens with Unsafe AuthoritiesFixed
The report gives no description here.
Show 6 more
LowPDA Bumps Re-derived Instead of Using Stored Values in Finalize InstructionFixed
The report gives no description here.
LowRate Limiting Scope Is Not Documented in the Threat ModelFixed
The report gives no description here.
LowRedundant Oracle Price Calculation in Gas Route DepositFixed
The report gives no description here.
LowRedundant Payload Validation in Funds Route HandlerFixed
The report gives no description here.
Lowset_token_rate_limit Unconditionally Resets Epoch Usage on Threshold UpdateFixed
The report gives no description here.
LowUnprotected Initialization Allows First-Caller TakeoverFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (17)
- admin.rs
- tss.rs
- execute.rs
- rate_limit.rs
- mod.rs
- initialize.rs
- withdraw.rs
- encoding.rs
- deposit.rs
- revert.rs
- validation.rs
- pricing.rs
- rescue.rs
- lib.rs
- errors.rs
- state.rs
- transfers.rs
Part of Push Chain’s security record
Push ChainSecurity firm
Hacken343 projects reviewed · 476 reports · latest Sep 2026
See Hacken’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us