Dexalot / Solana

Hacken29 Aug 20251 address on Avalanche

Hacken reviewed Dexalot (Dexalot / Solana) on 29 Aug 2025: 16 findings, 1 critical; all marked fixed.

1 critical finding, fixed

Open the report Open Dexalot’s security record

Report hosted on hacken.io.

Trustblock does not review code.

Findings16

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	1
High	0	0	4
Medium	0	0	5
Low	0	0	6

Critical[DualDefense] Arbitrary Admin Role Claim Through Account Initialization OrderingFixed

The report gives no description here.

High[DualDefense] Critical Token‑Confusion VulnerabilityFixed

The report gives no description here.

High[DualDefense] Dest‑Trader Account not Bound to Order Dest_Trader FieldFixed

The report gives no description here.

High[DualDefense] Missing Validation Allows Theft of Queued Swap TokensFixed

The report gives no description here.

HighArbitrary Funds Destination due to Lack of Accounts Validation in LzReceiveFixed

The report gives no description here.

Medium[DualDefense] Partial Swaps are not Accounted for Leading to Loss of Takers FundsFixed

The report gives no description here.

Medium[DualDefense] Portfolio Lamports DrainFixed

The report gives no description here.

MediumArbitrary LayerZero Endpoint ProgramFixed

The report gives no description here.

MediumPause Functionality Implemented PartiallyFixed

The report gives no description here.

MediumSupported Tokens List Functionality Implemented PartiallyFixed

The report gives no description here.

Show 6 more

LowFloating Toolchain VersionFixed

The report gives no description here.

LowInconsistent Deposit Pause FunctionalityFixed

The report gives no description here.

LowRedundant Account InitializationsFixed

The report gives no description here.

LowRedundant Bumps RecalculationFixed

The report gives no description here.

LowRedundant Getter InstructionFixed

The report gives no description here.

LowRedundant Portfolio PDA FieldsFixed

The report gives no description here.

Contracts in scope1

Address	Chain	Source code
0x093783055f9047c2bff99c4e414501f8a147bc69	Chain: Avalanche	Source code: Verified source

Part of Dexalot’s security record

Dexalot

Audits3 audits by 1 firmLast audit Apr 2026, by Hacken.

Critical findingsNo open critical findingsAcross the 3 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it.

Open Dexalot’s security record

Security firm

Hacken

343 projects reviewed · 476 reports · latest Sep 2026

See Hacken’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.