Push Chain / Core Contracts

HackenRepository at commit 15b7054

Audit

Hacken reviewed Push Chain (Push Chain / Core Contracts) on 13 Apr 2026: 48 findings, 0 critical; 36 marked fixed, 6 acknowledged, 6 open.

No open critical findings
Open the reportOpen Push Chain’s security record

Report hosted on hacken.io.

Trustblock does not review code.

Findings48

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium004
Low6631
HighERC-20 Return Path Missing Token Approval Despite Documentation RequirementFixed

The report gives no description here.

MediumCEA Migration Path Does Not Enforce Self-Targeting SemanticsFixed

The report gives no description here.

MediumdefaultDeadlineMins Default Value Is Not Initialized in Proxy StorageFixed

The report gives no description here.

MediumDomain Separator Omits Push Chain Network Identifier, Enabling Cross-Deployment Signature ReplayFixed

The report gives no description here.

MediumSVM Domain Separator Encodes chainId Incorrectly Relative to EIP-712Fixed

The report gives no description here.

LowAbsence of Granular Role SeparationFixed

The report gives no description here.

LowCEA Multicall Discards Underlying Revert ReasonsFixed

The report gives no description here.

LowCustom Errors Can Be Used for Gas EfficiencyFixed

The report gives no description here.

LowDeposit Event Misreports the Effective Mint CallerFixed

The report gives no description here.

LowEmpty Revert Messages in WPC Reduce Failure ObservabilityFixed

The report gives no description here.

Show 10 more
LowGas Token Updates Do Not Invalidate Chain Gas Price ConfigurationFixed

The report gives no description here.

LowgetOriginForUEA Returns Synthetic Identity With Hardcoded Push Chain IDFixed

The report gives no description here.

LowInconsistent Zero-Value Handling for Base and Rescue Gas LimitsFixed

The report gives no description here.

LowinitializeCEA Arguments Differ From Documented SpecificationFixed

The report gives no description here.

LowMissing Events for Critical Admin Configuration ChangesFixed

The report gives no description here.

LowMissing Reentrancy Guard on depositPRC20TokenFixed

The report gives no description here.

LowPC Can Become Permanently Stuck Due to Missing Rescue PathFixed

The report gives no description here.

LowPRC20 Direct Mint Path Bypasses UniversalCore PauseFixed

The report gives no description here.

LowProxy Initialization Validation Is Inconsistent Between CEAProxy and UEAProxyFixed

The report gives no description here.

LowRedundant Role Check in Batch Registration Increases Gas CostsFixed

The report gives no description here.

Show 10 more
LowregisterUEA Can Overwrite Existing VM Implementation MappingFixed

The report gives no description here.

LowReturn Values from IPRC20.deposit and IPRC20.approve Are IgnoredFixed

The report gives no description here.

LowRole Management Surface for PAUSER_ROLE Is Inconsistent and Potentially MisleadingFixed

The report gives no description here.

LowSafeERC20 Is Imported but Never Used in CEAFixed

The report gives no description here.

LowsetChainMeta Allows Zero Gas Price, Causing Quote Path DoSFixed

The report gives no description here.

LowsetDefaultFeeTier Rejects Valid Uniswap V3 1 bps Fee TierFixed

The report gives no description here.

LowslippageTolerance Is Configurable but Never EnforcedFixed

The report gives no description here.

LowtotalSupply in WPC Can Be Inflated by Force-Sent Native PCFixed

The report gives no description here.

LowtransferFrom in PRC20 Performs Balance Transfer Before Allowance ValidationFixed

The report gives no description here.

LowuniswapV3Quoter Is Stored but Never UsedFixed

The report gives no description here.

Show 6 more
LowUniversalCore Documentation Is Out of Sync With ImplementationFixed

The report gives no description here.

LowUnused isSupportedToken Gate Allows Configuration DriftFixed

The report gives no description here.

LowUnused SafeERC20 Import and Inconsistent ERC-20 HandlingFixed

The report gives no description here.

LowUse of Magic Numbers Reduces Clarity and Increases Maintenance Risk in UniversalCoreFixed

The report gives no description here.

LowWPC.withdraw Uses .transfer (2300 Gas Limit)Fixed

The report gives no description here.

LowZero baseGasLimit Can Produce Zero Gas Fee QuoteFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (98)

  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UEA/UEA_EVM.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/mocks/MockPRC20.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/Interfaces/ICEA.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UEA/UEAProxy.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/cea/CEAProxy.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UEA/UEAMigration.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/test/mocks/MockPRC20.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/mocks/MockWPC.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UEA/UEAMigration.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UniversalCore.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UEA/UEA_SVM.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/Interfaces/IUniversalCore.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/test/mocks/MockWPC.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/test/mocks/MaliciousPRC20.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/test/mocks/MockPRC20.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/test/mocks/RevertingPRC20.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UEA/UEAProxy.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UEA/UEA_EVM.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/libraries/Utils.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/test/mocks/RevertingPRC20.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/Interfaces/IPRC20.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UEA/UEA_SVM.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UEA/UEA_EVM.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/test/mocks/MaliciousPRC20.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/Interfaces/IWPC.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/uea/UEAFactory.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/PRC20.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/PRC20.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UEA/UEA_SVM.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/test/mocks/MockWPC.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/test/mocks/MockPRC20.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/uea/UEAProxy.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/WPC.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UEA/UEAMigration.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UniversalCore.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/libraries/Utils.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/uea/UEAMigration.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/WPC.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/test/mocks/MaliciousPRC20.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UEA/UEAProxy.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/libraries/Utils.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/UniversalCore.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/test/mocks/RevertingPRC20.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/test/mocks/MaliciousPRC20.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/Interfaces/IUEAFactory.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/cea/CEA.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/libraries/Utils.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UEA/UEAMigration.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/cea/CEAMigration.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/WPC.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/test/mocks/MockPRC20.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/Interfaces/ICEAFactory.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/uea/UEA_EVM.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/mocks/RevertingPRC20.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UniversalCore.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UEA/UEA_EVM.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/WPC.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/test/mocks/MockWPC.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/WPC.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UEA/UEAMigration.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UEA/UEA_SVM.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/cea/CEAFactory.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/libraries/Utils.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/PRC20.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UEA/UEAMigration.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/PRC20.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/PRC20.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/test/mocks/MockPRC20.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/test/mocks/MaliciousPRC20.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/test/mocks/MockWPC.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/test/mocks/RevertingPRC20.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UEA/UEA_SVM.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/WPC.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UniversalCore.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UEA/UEA_EVM.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/test/mocks/RevertingPRC20.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UniversalCore.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/test/mocks/MaliciousPRC20.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/mocks/MaliciousPRC20.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/libraries/Types.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/test/mocks/MockWPC.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/test/mocks/RevertingPRC20.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UEA/UEAProxy.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/PRC20.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UEA/UEA_EVM.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/UEA/UEAProxy.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UEA/UEA_SVM.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/PRC20.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/coverage-report/src/WPC.sol.gcov.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UEA/UEAProxy.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/UniversalCore.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/src/libraries/Utils.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/test/mocks/MockPRC20.sol.func.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/libraries/Errors.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/test/coverage/test/mocks/MockWPC.sol.func-c.html at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/Interfaces/ICEAProxy.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/uea/UEA_SVM.sol at commit 15b7054
  • https://github.com/pushchain/push-chain-core-contracts/src/libraries/Utils.sol at commit 15b7054

Part of Push Chain’s security record

Push Chain
Audits3 audits by 1 firmLast audit Aug 2026, by Hacken.
Critical findingsNo open critical findingsAcross 3 reports.
Open Push Chain’s security record

Security firm

Hacken

343 projects reviewed · 476 reports · latest Sep 2026

See Hacken’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us