Securitize Solana Bridge Audit Report

CyfrinCode version: not recorded (see the report)

Cyfrin reviewed Securitize (Securitize Solana Bridge Audit Report) on 30 Apr 2026: 22 findings, 0 critical; 15 marked fixed, 7 acknowledged.

No open critical findings
Open Securitize’s security record

The original report was removed from its address (seen 17 Oct 2026).

Trustblock does not review code.

Findings22

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High011
Medium043
Low0211
HighEVM-to-Solana Transfers Can Permanently Burn Tokens by Producing a VAA That Solana Cannot DecodeAcknowledged

The report gives no description here.

MediumCross-Chain Decimal Mismatch Causes Silent Value Corruption on MintAcknowledged

The report gives no description here.

MediumInbound Transfers Mint Against Stale Destination Identity State Bypassing Jurisdiction-Specific Lock PeriodsAcknowledged

The report gives no description here.

MediumSource-Chain Transfer-Hook Policies Are Bypassed by the Bridge Burn/Remint PathAcknowledged

The report gives no description here.

MediumUnbounded TrackerAccount.issuances Growth Enables Relayer Rent Griefing and Eventual Bridge DoSAcknowledged

The report gives no description here.

LowBridge flows do not implement on-chain rate limiting or cumulative volume capsAcknowledged

The report gives no description here.

LowPause blocks inbound VAA execution, stranding in-flight cross-chain transfersAcknowledged

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Securitize’s security record

Securitize
Audits37 audits by 2 firmsLast audit Sep 2026, by Cyfrin.
Critical findingsNo open critical findingsAcross the 37 reports, 6 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Securitize’s security record

Security firm

Cyfrin

28 projects reviewed · 79 reports · latest Sep 2026

See Cyfrin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us