atomiq.exchange security review

Off-Chain (Private)

Audited on 2025/07/25

No active critical issues

Summary

This document presents the security review performed by Cairo Security Clan on the atomiq.exchange, a fully trustless cross-chain decentralized exchange allowing atomic swaps between smart chains and bitcoin with strong security guarantees based on bitcoin light client leveraging proof-of-work security and submarine swaps using hash-time locked contracts over bitcoin's lightning network. The audit included manual and automated code analysis, simulations, and edge test cases, identifying 6 points of attention including 1 high, 2 medium, 1 informational, and 2 best practices issues.

Project

Atomiq Exchange

Multi-Chain

Issues (6)

	Low	Medium	High	Critical	Total
Not fixed	2	1	-	-	3
Fixed	1	1	1	-	3
Total	3	2	1	0	6

Contracts (42)

#	File Name
21	contracts/escrow_manager/state/reputationState.sol
22	contracts/escrow_manager/events.sol
23	contracts/spv_swap_vault/utils.sol
24	contracts/spv_swap_vault/structs/bitcoinVaultTransactionData.sol
25	contracts/btc_relay/state/btcRelayState.sol
26	contracts/btc_utils/endianness.sol
27	contracts/btc_relay/constants.sol
28	contracts/escrow_manager/components/reputationTracker.sol
29	contracts/spv_swap_vault/spvVaultManager.sol
30	contracts/btc_relay/utils/difficulty.sol

#	File Name
21	contracts/escrow_manager/state/reputationState.sol
22	contracts/escrow_manager/events.sol
23	contracts/spv_swap_vault/utils.sol
24	contracts/spv_swap_vault/structs/bitcoinVaultTransactionData.sol
25	contracts/btc_relay/state/btcRelayState.sol
26	contracts/btc_utils/endianness.sol
27	contracts/btc_relay/constants.sol
28	contracts/escrow_manager/components/reputationTracker.sol
29	contracts/spv_swap_vault/spvVaultManager.sol
30	contracts/btc_relay/utils/difficulty.sol

atomiq.exchange security review

Summary

Issues (6)

success action execution failures do not revert the claim transactionnot_fixed/medium

claimer cannot initialize escrow with native ethnot_fixed/low

deposit function should use safe arithmetic operations like withdraw functionnot_fixed/low

Contracts (42)