Securitize ZKsync Exit Bridge Audit Report

ZKSyncSecuritizeBridge::bridgeDSTokens enforces only a subset of the destination’s issuance compliance, allowing burns that cannot be minted on Ethereum

not_fixed/low

Redundant SLOAD of dsToken in Securitize- Bridge::bridgeDSTokensToAddress

acknowledged/low

Redundant SLOAD of USDC in USDCBridgeV2::_transferUSDC

acknowledged/low

SecuritizeBridge::executeVAAv1 never checks vm.consistencyLevel so non-finalized VAAs can be consumed, enabling reorg-based supply inflation

acknowledged/low

SecuritizeBridge::executeVAAv1 VAA payload omits destination-contract binding, enabling cross-instance double-mint across co-deployed bridge instances on one chain

acknowledged/low