Dexalot / Bridge
Hacken reviewed Dexalot (Dexalot / Bridge) on 21 Apr 2026: 59 findings, 1 critical; 40 marked fixed, 3 acknowledged, 16 open.
Report hosted on hacken.io.
Trustblock does not review code.
Findings59
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 0 |
| Medium | 1 | 0 | 4 |
| Low | 15 | 3 | 35 |
CriticalInverted isDirect Flag Logic Causes ERC20 Tokens to Not Be Collected in Direct SwapsFixed
The report gives no description here.
MediumAuction Mode Bypass in bulkTransferTokens Allows Transfers During Active AuctionsFixed
The report gives no description here.
MediumdepositTokenFromContract Cannot Pay Bridge FeesFixed
The report gives no description here.
MediumFront-Running DoS on Batch Settlement via Rolling Hash InvalidationFixed
The report gives no description here.
MediumMissing Gas Tank Auto-Fill for Recipients in Bulk TransfersFixed
The report gives no description here.
Low[DualDefense] Current Design Allows for maxPerDeposit To Be Bypassed via Same tokenIds in requestDepositFixed
The report gives no description here.
Low[DualDefense] Duplicate-Heavy Deposit Batches Are Atomic, Cannot Be Partially Settled, and Block Follower BatchesFixed
The report gives no description here.
Low[DualDefense] finalizeBatch Can Never Finalize Batch Zero Because It Reads batchId - 1 Before The Zero-Batch GuardFixed
The report gives no description here.
LowcalculateWithdrawalFee Returns Zero Fee for Zero Inventory Instead of RevertingFixed
The report gives no description here.
LowDefensive Check Ordering in _calcSharesToMint Allows Theoretical Division by ZeroFixed
The report gives no description here.
Show 10 more
LowDivision by Zero When Withdrawing Total Remaining InventoryFixed
The report gives no description here.
LowExcess Native Token Not Refunded When User Pays Bridge FeeFixed
The report gives no description here.
LowFirst Batch Vulnerable to Immediate UnwindFixed
The report gives no description here.
LowGas Inefficiency in powMultipleOf4BPSFixed
The report gives no description here.
LowInconsistent Documentation for Default Allowed Slippage PercentFixed
The report gives no description here.
LowInconsistent Native Token Handling in sendTokenBalance FunctionFixed
The report gives no description here.
LowInverted NatSpec Comment in _updateTakerFeeCollectorFixed
The report gives no description here.
LowK Value Not Validated as Multiple of 4 Causes Incorrect Fee CalculationFixed
The report gives no description here.
LowMisleading Documentation and Dead Code in floor FunctionFixed
The report gives no description here.
LowMisleading NatSpec Comment in powMultipleOf4BPS FunctionFixed
The report gives no description here.
Show 10 more
LowMissing Explicit Check for Maximum Token Limit Results in Overflow RevertFixed
The report gives no description here.
LowMissing msg.value Validation for Native Token SwapsFixed
The report gives no description here.
LowMissing NatSpec Documentation for Function Parameters in PortfolioSubFixed
The report gives no description here.
LowMissing Reentrancy Guards on Swap Functions Reduces Defense-in-DepthFixed
The report gives no description here.
LowMissing Token Validation in Withdrawal Settlement Allows Arbitrary Asset DispatchFixed
The report gives no description here.
LowMissing tokenType Validation Allows Irreversible Token InvalidationFixed
The report gives no description here.
LowMissing Validation for Duplicate and Empty Token SymbolsFixed
The report gives no description here.
LowNative Tokens Lost During ERC20 Swaps Through RouterFixed
The report gives no description here.
LowNo Mechanism to Remove Whitelisted Functions in OmniVaultExecutorFixed
The report gives no description here.
LowOff-by-One Error in PortfolioBridgeMain Contract Balance CheckFixed
The report gives no description here.
Show 10 more
Lowreceive Function in DexalotRouter Accepts ETH Without Processing, Leading to Stuck FundsFixed
The report gives no description here.
LowRedundant Conditional Logic in decrement FunctionFixed
The report gives no description here.
LowSilent Failure in matchAuctionOrder Causes Infinite Loop in matchAuctionOrdersFixed
The report gives no description here.
LowSwitching to bulkTransferTokens Removes AutoFill Functionality for Claim RecipientsFixed
The report gives no description here.
LowUndocumented Zero Parameters in getNativeBridgeFeeFixed
The report gives no description here.
LowUnrestricted Share Minting by Settler Role Enables Value Extraction from DepositorsFixed
The report gives no description here.
LowUnrestricted Withdrawal Amounts by Settler Role Enables Value Extraction from Withdrawing UsersFixed
The report gives no description here.
LowUse of Deprecated transfer Function for Native Token WithdrawalFixed
The report gives no description here.
LowVault Status Management Allows Setting NONE/DEPRECATED Status, Locking User FundsFixed
The report gives no description here.
LowWhitelisted Function Selector Mapping May Silently Overwrite Existing EntriesFixed
The report gives no description here.
Contracts in scope1
| Address | Chain | Source code |
|---|---|---|
| 0x093783055f9047c2bff99c4e414501f8a147bc69 | Chain: Avalanche | Source code: Verified source |
Part of Dexalot’s security record
DexalotSecurity firm
Hacken343 projects reviewed · 476 reports · latest Sep 2026
See Hacken’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us