atomiq.exchange security review

Off-Chain (Private)

Audited on 2025/07/25

No active critical issues

Summary

This document presents the security review performed by Cairo Security Clan on the atomiq.exchange, a fully trustless cross-chain decentralized exchange allowing atomic swaps between smart chains and bitcoin with strong security guarantees based on bitcoin light client leveraging proof-of-work security and submarine swaps using hash-time locked contracts over bitcoin's lightning network. The audit included manual and automated code analysis, simulations, and edge test cases, identifying 6 points of attention including 1 high, 2 medium, 1 informational, and 2 best practices issues.

Project

Atomiq Exchange

Multi-Chain

Issues (6)

	Low	Medium	High	Critical	Total
Not fixed	2	1	-	-	3
Fixed	1	1	1	-	3
Total	3	2	1	0	6

Contracts (42)

#	File Name
11	contracts/btc_nonced_output_claim_handler/bitcoinNoncedOutputClaimHandler.sol
12	contracts/btc_relay/structs/storedBlockHeader.sol
13	contracts/btc_utils/bitcoinTx.sol
14	contracts/execution_contract/events.sol
15	contracts/execution_contract/structs/execution.sol
16	contracts/escrow_manager/components/escrowStorage.sol
17	contracts/escrow_manager/components/eip712SigHash.sol
18	contracts/btc_relay/utils/nbits.sol
19	contracts/escrow_manager/escrowManager.sol
20	contracts/execution_proxy/structs/contractCall.sol

#	File Name
11	contracts/btc_nonced_output_claim_handler/bitcoinNoncedOutputClaimHandler.sol
12	contracts/btc_relay/structs/storedBlockHeader.sol
13	contracts/btc_utils/bitcoinTx.sol
14	contracts/execution_contract/events.sol
15	contracts/execution_contract/structs/execution.sol
16	contracts/escrow_manager/components/escrowStorage.sol
17	contracts/escrow_manager/components/eip712SigHash.sol
18	contracts/btc_relay/utils/nbits.sol
19	contracts/escrow_manager/escrowManager.sol
20	contracts/execution_proxy/structs/contractCall.sol

atomiq.exchange security review

Summary

Issues (6)

success action execution failures do not revert the claim transactionnot_fixed/medium

claimer cannot initialize escrow with native ethnot_fixed/low

deposit function should use safe arithmetic operations like withdraw functionnot_fixed/low

Contracts (42)