Securitize ZKsync Exit Bridge Audit Report
Cyfrin reviewed Securitize (Securitize ZKsync Exit Bridge Audit Report) on 10 Jun 2026: 4 findings, 0 critical; 1 marked fixed, 2 acknowledged, 1 open.
No open critical findings
Open Securitize’s security record
The original report was removed from its address (seen 18 Oct 2026).
Trustblock does not review code.
Findings4
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 1 | 2 | 1 |
LowSecuritizeBridge::executeVAAv1 never checks vm.consistencyLevel so non-finalized VAAs can be consumed, enabling reorg-based supply inflationAcknowledged
The report gives no description here.
LowSecuritizeBridge::executeVAAv1 VAA payload omits destination-contract binding, enabling cross-instance double-mint across co-deployed bridge instances on one chainAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Securitize’s security record
SecuritizeAudits37 audits by 2 firmsLast audit Sep 2026, by Cyfrin.
Critical findingsNo open critical findingsAcross the 37 reports, 6 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Securitize’s security recordSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us