atomiq.exchange security review

Off-Chain (Private)

Audited on 2025/07/25

No active critical issues

Summary

This document presents the security review performed by Cairo Security Clan on the atomiq.exchange, a fully trustless cross-chain decentralized exchange allowing atomic swaps between smart chains and bitcoin with strong security guarantees based on bitcoin light client leveraging proof-of-work security and submarine swaps using hash-time locked contracts over bitcoin's lightning network. The audit included manual and automated code analysis, simulations, and edge test cases, identifying 6 points of attention including 1 high, 2 medium, 1 informational, and 2 best practices issues.

Project

Atomiq Exchange

Multi-Chain

Issues (6)

	Low	Medium	High	Critical	Total
Not fixed	2	1	-	-	3
Fixed	1	1	1	-	3
Total	3	2	1	0	6

Contracts (42)

#	File Name
1	contracts/escrow_manager/components/lpVault.sol
2	contracts/execution_proxy/executor.sol
3	contracts/common/iRefundHandler.sol
4	contracts/btc_relay/structs/compactBlockHeader.sol
5	contracts/common/iClaimHandler.sol
6	contracts/btc_output_claim_handler/bitcoinOutputClaimHandler.sol
7	contracts/execution_proxy/structs/executionAction.sol
8	contracts/execution_contract/executionContract.sol
9	contracts/btc_relay/events.sol
10	contracts/btc_txid_claim_handler/bitcoinTxIdClaimHandler.sol

#	File Name
1	contracts/escrow_manager/components/lpVault.sol
2	contracts/execution_proxy/executor.sol
3	contracts/common/iRefundHandler.sol
4	contracts/btc_relay/structs/compactBlockHeader.sol
5	contracts/common/iClaimHandler.sol
6	contracts/btc_output_claim_handler/bitcoinOutputClaimHandler.sol
7	contracts/execution_proxy/structs/executionAction.sol
8	contracts/execution_contract/executionContract.sol
9	contracts/btc_relay/events.sol
10	contracts/btc_txid_claim_handler/bitcoinTxIdClaimHandler.sol

atomiq.exchange security review

Summary

Issues (6)

success action execution failures do not revert the claim transactionnot_fixed/medium

claimer cannot initialize escrow with native ethnot_fixed/low

deposit function should use safe arithmetic operations like withdraw functionnot_fixed/low

Contracts (42)