Across Audit

OpenZeppelinRepository at commit 5a0c67c

Audit · firm’s term: audit

OpenZeppelin reviewed Across Protocol (Across Audit) on 12 May 2025: 14 findings, 1 critical; 13 marked fixed, 1 acknowledged.

1 critical finding, fixed
Open the reportOpen Across Protocol’s security record

Report hosted on blog.openzeppelin.com.

Trustblock does not review code.

Findings14

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical001
High002
Medium008
Low012
CriticalMissing Access Control for setDestinationSettlerFixed

The report gives no description here.

HighForwarder and Withdrawal Helper Contracts Do Not Handle ETH Transfers CorrectlyFixed

The report gives no description here.

HighSpokePool's fill Function Performs Malformed CallFixed

The report gives no description here.

MediumAttempts to Bridge WETH Using ZkStack_CustomGasToken_Adapter Will FailFixed

The report gives no description here.

MediumGriefing Attacks Are Possible in ZK AdaptersFixed

The report gives no description here.

MediumIncorrect Parameters Passed to permitWitnessTransferFromFixed

The report gives no description here.

MediumNo Way to Invoke Some Privileged Functions of ForwardersFixed

The report gives no description here.

MediumrelayTokens Calls Made By Forwarders May FailFixed

The report gives no description here.

MediumSome Contracts Might Not Work Properly with USDT AllowanceFixed

The report gives no description here.

MediumTransfers of The Target Chain's Gas Token Will FailFixed

The report gives no description here.

Show 3 more
MediumTypes Incompatible With ERC-7683Fixed

The report gives no description here.

LowChanging crossDomainAdmin Will Prohibit Pending OperationsFixed

The report gives no description here.

LowIncorrect CastsFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (18)

  • https://github.com/across-protocol/contracts/contracts/SpokePool.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/chain-adapters/Router_Adapter.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/chain-adapters/ZkStack_CustomGasToken_Adapter.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/erc7683/ERC7683OrderDepositor.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/chain-adapters/l2/Ovm_WithdrawalHelper.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/chain-adapters/Arbitrum_Forwarder.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/chain-adapters/ZkStack_Adapter.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/libraries/CrossDomainAddressUtils.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/erc7683/ERC7683.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/chain-adapters/ForwarderBase.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/erc7683/ERC7683OrderDepositorExternal.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/erc7683/ERC7683Across.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/interfaces/V3SpokePoolInterface.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/chain-adapters/l2/Arbitrum_WithdrawalHelper.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/WorldChain_SpokePool.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/chain-adapters/WorldChain_Adapter.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/chain-adapters/Ovm_Forwarder.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1
  • https://github.com/across-protocol/contracts/contracts/chain-adapters/l2/WithdrawalHelperBase.sol at commit 5a0c67c984d19a3bb843a4cec9bb081734583dd1

Part of Across Protocol’s security record

Across Protocol
Audits15 audits by 1 firmLast audit May 2025, by OpenZeppelin.
Critical findingsNo open critical findingsAcross the 15 reports, 4 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Across Protocol’s security record

Security firm

OpenZeppelin

67 projects reviewed · 184 reports · latest Aug 2026

See OpenZeppelin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us