Securitize Solana Bridge Audit Report
Cyfrin reviewed Securitize (Securitize Solana Bridge Audit Report) on 30 Apr 2026: 22 findings, 0 critical; 15 marked fixed, 7 acknowledged.
The original report was removed from its address (seen 17 Oct 2026).
Trustblock does not review code.
Findings22
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 1 |
| Medium | 0 | 4 | 3 |
| Low | 0 | 2 | 11 |
Marked Informational or Gas by the firm. Not counted as findings.
Informationalbridge_ds_tokens lamport pre-check excludes additional rent costsAcknowledged
The report gives no description here.
Informationalinitialize does not pin usdc_mint to the canonical Solana USDC mintAcknowledged
The report gives no description here.
GasUnnecessary Heap Clones of posted.payload and WormholeAddresses in Instruction HandlersAcknowledged
The report gives no description here.
Informationalupdate_wormhole_accounts is for recovery, or for migration after a bridge upgrade, not for routine reconfigurationAcknowledged
The report gives no description here.
InformationalUSDCBridgeSend does not expose a direct CCTP correlation identifierAcknowledged
The report gives no description here.
InformationalDead Code Where country_string_to_u8 and CctpDomainNotConfigured Are Not UsedFixed
The report gives no description here.
InformationalDS bridge initialize accepts zero-value parameters that update instructions rejectFixed
The report gives no description here.
InformationalExecutor quotes must use the same gas limit as on-chain executor_gas_limitFixed
The report gives no description here.
Informationalformat! used where .to_string() suffices for country conversionFixed
The report gives no description here.
InformationalGasLimitUpdate event in DS bridge uses u128 fields unnecessarilyFixed
The report gives no description here.
Show 10 more
GasInstruction Handlers Use find_program_address Where Cheaper Derivation Is AvailableFixed
The report gives no description here.
InformationalMagic numbers in securitize_usdc_bridge::initialize for default config valuesFixed
The report gives no description here.
InformationalMissing events for initialize instructions in both programsFixed
The report gives no description here.
InformationalMissing zero-value validation for gas_limit parameter in both bridgesFixed
The report gives no description here.
InformationalNo ownership transfer mechanism for bridge config in either programFixed
The report gives no description here.
InformationalPauseStatusChanged is not mint-self-describing for off-chain consumersFixed
The report gives no description here.
Gasposted.payload.clone() copies entire VAA payload unnecessarily in execute_vaa_v1Fixed
The report gives no description here.
Informationalread_current_sequence uses ANCHOR_DISCRIMINATOR_LEN for raw Wormhole u64 dataFixed
The report gives no description here.
GasRedundant immutable borrow in set_bridge_address and set_emitter_addressFixed
The report gives no description here.
GasResolver Re-derives PDAs Already Computed by Caller, Wasting ~4,500+ CU per ResolutionFixed
The report gives no description here.
Show 2 more
InformationalResolverConfig PDA uses big-endian chain seed while other chain-seeded PDAs use little-endianFixed
The report gives no description here.
Informationalset_cctp_domain uses bump value of 0 as sentinel for new account detectionFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Securitize’s security record
SecuritizeSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us