M0 Liquidity Delivery Review Report
Audit · firm’s term: security review
Guardian Audits reviewed M0 (M0 Liquidity Delivery Review Report) on 30 Jan 2026: 32 findings, 3 critical; 25 marked fixed, 7 acknowledged.
Findings32
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 3 |
| High | 0 | 0 | 5 |
| Medium | 0 | 1 | 9 |
| Low | 0 | 6 | 8 |
CriticalAnyone Can Replay The M0 Transfer Between SpokesFixed
The report gives no description here.
CriticalCross Chain Orders Can Be Canceled From SourceFixed
The report gives no description here.
CriticalOrderbook Drained Due To Cancelled OrdersFixed
The report gives no description here.
HighCrosschain Orders Cannot Be Filled On EVMFixed
The report gives no description here.
HighIncorrect Scaling Of Token AmountFixed
The report gives no description here.
HighPortals Cannot Send Cancel ReportsFixed
The report gives no description here.
HighStuck Funds Due To Non-isolated SpokesFixed
The report gives no description here.
HighSVM Payload Is MalformedFixed
The report gives no description here.
MediumCancel Race Condition Reintroduced On SVMFixed
The report gives no description here.
MediumDelivery Of Signed Cancellations Can Be GriefedFixed
The report gives no description here.
Show 10 more
MediumHardcoded Chain ID Vulnerable To ReplayFixed
The report gives no description here.
MediumIsolated Spokes Can Receive Tokens From SVMFixed
The report gives no description here.
MediumLoss For Solvers Due To A Cancel Race ConditionFixed
The report gives no description here.
MediumMerkle Root Updates Cannot Be Send To SVMFixed
The report gives no description here.
MediumPortal Initialize Logic Cannot Be ExecutedFixed
The report gives no description here.
MediumSVM: M Supply Inflation Due To Missing BurnFixed
The report gives no description here.
MediumSVM: Race Condition For Earner Merkle RootsFixed
The report gives no description here.
LowDo Not Reset Finality On Removed SupportFixed
The report gives no description here.
LowGasless Order VERSION Is Not VerifiedFixed
The report gives no description here.
LowInaccurate Comment Regarding Chain ID DefinitionFixed
The report gives no description here.
Show 5 more
LowIncorrect Comment _revertIfTokenTransferDisabledFixed
The report gives no description here.
LowIndex Should Be Updated During All xChain InteractionsFixed
The report gives no description here.
LowLack Of Address(0) Check For Default AdapterFixed
The report gives no description here.
LowMissing Check If Default Adapter Is SupportedFixed
The report gives no description here.
LowUnscaled Amount Emitted In TokenSentFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of M0’s security record
M0Security firm
Guardian Audits15 projects reviewed · 99 reports · latest Aug 2026
See Guardian Audits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us