Sweep-n-flip Bridge
Cantina reviewed Sweep n Flip (Sweep-n-flip Bridge) on 16 Jan 2025: 36 findings, 2 critical; 14 marked fixed, 22 acknowledged.
Report hosted on cantina.xyz.
Trustblock does not review code.
Findings36
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 2 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 1 | 3 |
| Low | 0 | 19 | 9 |
CriticalLayerZeroAdapter::executeMessages could lead to irrecoverable stateAcknowledged
The report gives no description here.
CriticalPermanent failure to bridge wrapped ERC721 using Bridge::sendERC721UsingNative functionAcknowledged
The report gives no description here.
MediumPrivileged role and actions lead to centralization risks for usersAcknowledged
The report gives no description here.
LowBridge.sol is incompatible with multi-chain ERC-721 contractsAcknowledged
The report gives no description here.
LowCode quality issues: function orderingAcknowledged
The report gives no description here.
LowCode quality issues: remove unused function parameterAcknowledged
The report gives no description here.
LowCode quality issues: unused ExcessivelySafeCall libraryAcknowledged
The report gives no description here.
LowCode quality issues: unused imports (or) codeAcknowledged
The report gives no description here.
LowCombine checkEvmChainSettingsAdapter and checkEvmChainSettingsIsEnabled to improve gas efficiencyAcknowledged
The report gives no description here.
LowEmit events if a function alters storage variablesAcknowledged
The report gives no description here.
Show 10 more
LowERC20 swaps are allowed on SwipNFlip pools without NFT retrievalAcknowledged
The report gives no description here.
LowImprove inline documentationAcknowledged
The report gives no description here.
LowIncrease test coverageAcknowledged
The report gives no description here.
Lowmemory can be changed to calldata to save gasAcknowledged
The report gives no description here.
LowMissing events and sanity checks in Bridge.sol state changing functionsAcknowledged
The report gives no description here.
Lowname(), symbol() and tokenURI() are optional functions, per the ERC-721 standardAcknowledged
The report gives no description here.
Lows_bridgeAddress could be made immutableAcknowledged
The report gives no description here.
LowUnnecessary local contract duplication of LayerZero OApp contractsAcknowledged
The report gives no description here.
LowUnnecessary use of tryDiv for division with a constantAcknowledged
The report gives no description here.
LowUnsafe casting of uint256 to uint32 in LayerZeroAdapter.solAcknowledged
The report gives no description here.
Show 2 more
LowUse _safeMint instead of _mint in WERC721 contractAcknowledged
The report gives no description here.
LowUse safeTransferFrom instead of transferFrom to transfer NFTsAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Sweep n Flip’s security record
Sweep n FlipSecurity firm
Cantina37 projects reviewed · 175 reports · latest Oct 2026
See Cantina’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us