Dexalot / Bridge

Hacken21 Apr 20261 address on Avalanche

Hacken reviewed Dexalot (Dexalot / Bridge) on 21 Apr 2026: 59 findings, 1 critical; 40 marked fixed, 3 acknowledged, 16 open.

1 critical finding, fixed

Open the report Open Dexalot’s security record

Report hosted on hacken.io.

Trustblock does not review code.

Findings59

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	1
High	0	0	0
Medium	1	0	4
Low	15	3	35

MediumUntrusted Contract Remains Callable via Whitelisted Function After Trust RevocationOpen

The report gives no description here.

LowCross-Chain Message Loss During Contract Upgrade Due to Payload Format IncompatibilityOpen

The report gives no description here.

LowDenial of Service via Global Pending Request Limit ExhaustionOpen

The report gives no description here.

Lowfallback Ignores ContractAccess Type, Allowing Function Execution on Contracts With Restricted Access LevelsOpen

The report gives no description here.

LowImmutable swapSigner Prevents Key Rotation and Creates Irrecoverable Compromise RiskOpen

The report gives no description here.

LowMissing Event Emissions for Key State Changes in Vault ContractsOpen

The report gives no description here.

LowMissing Event Emissions for State-Changing FunctionsOpen

The report gives no description here.

LowMissing Reentrancy Guard in multiPartialSwap and fallback FunctionsOpen

The report gives no description here.

LowMissing Validation in setDisplayDecimals Can Cause DoS for Trade PairOpen

The report gives no description here.

LowRemoval of Pause Functionality Eliminates Emergency Response CapabilityOpen

The report gives no description here.

Show 6 more

LowRemoval of Swap Expiry Mechanism Prevents Server-Side Quote InvalidationOpen

The report gives no description here.

LowSemantic Storage Variable Change Requires Migration During InventoryManager UpgradeOpen

The report gives no description here.

LowStrict Payload Length Validation May Reject In-Flight Messages During UpgradeOpen

The report gives no description here.

LowTRUSTED_TRANSFER_ROLE Allows Arbitrary Fund TransfersOpen

The report gives no description here.

LowUnenforced Invariant Between minTradeAmount and minPostAmount Causes Unexpected Order CancellationsOpen

The report gives no description here.

LowUnvalidated RFQ Address from Cross-Chain Payload Enables Potential Fund MisdirectionOpen

The report gives no description here.

Contracts in scope1

Address	Chain	Source code
0x093783055f9047c2bff99c4e414501f8a147bc69	Chain: Avalanche	Source code: Verified source

Part of Dexalot’s security record

Dexalot

Audits3 audits by 1 firmLast audit Apr 2026, by Hacken.

Critical findingsNo open critical findingsAcross the 3 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it.

Open Dexalot’s security record

Security firm

Hacken

343 projects reviewed · 476 reports · latest Sep 2026

See Hacken’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.