Securitize Solana Bridge Audit Report
Cyfrin reviewed Securitize (Securitize Solana Bridge Audit Report) on 30 Apr 2026: 22 findings, 0 critical; 15 marked fixed, 7 acknowledged.
The original report was removed from its address (seen 17 Oct 2026).
Trustblock does not review code.
Findings22
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 1 |
| Medium | 0 | 4 | 3 |
| Low | 0 | 2 | 11 |
Highbridge validate_locked_tokens diverges from PolicyEngine lock semantics and ignores manual locks with release_time == 0Fixed
The report gives no description here.
MediumOutbound bridge_ds_tokens shares a single writable Wormhole sequence per mint, enabling contention-based denial of service and low-volume griefing against stale client buildsFixed
The report gives no description here.
Mediumsend_usdc_cross_chain_deposit hard-couples caller and payer roles, blocking OnRamp CPI integrationFixed
The report gives no description here.
MediumShared ResolverConfig PDA Allows Cross-Instance Route Hijacking and DeletionFixed
The report gives no description here.
LowBridge initializes Wormhole outbound messages with Confirmed finality by default, weakening reorg safetyFixed
The report gives no description here.
LowConcurrent or pipelined resolves last-write-winsFixed
The report gives no description here.
LowCountry source inconsistency between lock validation and cross-chain payload in bridge_ds_tokensFixed
The report gives no description here.
LowEmitter rotation can strand old VAAs and collide with new-emitter sequence numbersFixed
The report gives no description here.
LowGlobal resolver result PDA can be closed by any BridgeConfig ownerFixed
The report gives no description here.
LowInbound execute_vaa_v1 does not validate posted VAA finalityFixed
The report gives no description here.
Show 5 more
LowOutbound Payload Encoding Uses panic! Instead of Anchor Error CodesFixed
The report gives no description here.
LowPartialPolicyEngine::deserialize_checked version auto-detection heuristic can misidentify account layout, corrupting lock period dataFixed
The report gives no description here.
LowPermissionless initialize combined with no ownership transfer and zero-value acceptance enables permanent bridge hijackingFixed
The report gives no description here.
LowStale ResolverConfig PDA persists when emitter address is updated in-placeFixed
The report gives no description here.
LowUsdcBridgeConfig::max_executor_fee defaults to zero, disabling the executor fee capFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Securitize’s security record
SecuritizeSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us