Securitize Jump Router Audit Report
Cyfrin reviewed Securitize (Securitize Jump Router Audit Report) on 9 Jun 2026: 5 findings, 0 critical; 2 marked fixed, 3 acknowledged.
The original report was removed from its address (seen 18 Oct 2026).
Trustblock does not review code.
Findings5
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 3 | 2 |
Marked Informational or Gas by the firm. Not counted as findings.
InformationalCombined internal and external fees are not cappedAcknowledged
The report gives no description here.
InformationalJumpRouterState collar and min-amount parameters have no bounds at init or in their settersAcknowledged
The report gives no description here.
GasRecomputed power-of-ten divisor in repeated per-swap price denormalizationAcknowledged
The report gives no description here.
InformationalRouter admin can repoint an existing router to an unrelated Jump poolAcknowledged
The report gives no description here.
InformationalUse a two-step admin transfer flow to reduce the risk of irreversible governance mistakesAcknowledged
The report gives no description here.
Informationalcalculate_jump_price requires mint decimals <= 18 but initialize and update_jump_pool_config never validate the boundFixed
The report gives no description here.
Informationalcalculate_jump_price returns a liquidity-over-asset ratio while three unit tests assert the inverseFixed
The report gives no description here.
InformationalFee collector default pubkey Is not rejected while InitializationFixed
The report gives no description here.
InformationalJumpRouterCounter uses init_if_needed with a fixed singleton seedFixed
The report gives no description here.
InformationalMbpsFeeManager doc comments mislabel milli-basis-points as basis pointsFixed
The report gives no description here.
Show 4 more
InformationalRedemptionCompleted emits gross liquidity output rather than the user’s net received amountFixed
The report gives no description here.
InformationalSource filename mpbs_fee_manager.rs has transposed lettersFixed
The report gives no description here.
InformationalStandard execute_swap accepts an empty regulatory external_idFixed
The report gives no description here.
InformationalUpdateJumpPoolConfig::update_jump_pool_config repoints mints but does not reset min_asset_amount_in, min_liquidity_amount_inFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Securitize’s security record
SecuritizeSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us