security review atomiq.exchange

Cairo Security ClanRepository at commit 50596c8

Audit · firm’s term: security review

Cairo Security Clan reviewed Atomiq Exchange (security review atomiq.exchange) on 7 Apr 2025: 9 findings, 0 critical; 4 marked fixed, 5 open.

No open critical findings
Open the reportOpen Atomiq Exchange’s security record
Report stored on IPFS. Content hash bafybeih56fjrsv6lpk6bmsccxkxmfkxj42zbnmya7vzbrjjemkof3z5x5m

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High102
Medium000
Low402
Highchain re-org could occur when a long fork is constructedFixed

In the btc_relay package, the process of submitting fork blockheaders for large forks (≥ 25 blocks) does not verify whether the block at fork_start_blockheight is still committed to the main chain when comparing forks' chain work. This can lead to a fork overtaking the main chain incorrectly if the main chain has been overtaken by a different fork replacing that block.

Highinvalid long fork could be mergedFixed

In the btc_relay package, when a fork occurs on the bitcoin main chain, the program allows anyone to submit fork blockheaders. These headers are automatically added to the main chain if their chain work surpasses that of the current main chain. For large forks (≥ 25 blocks), block headers are submitted across multiple transactions. The block headers are temporarily stored on-chain, and when the fork's chain work exceeds that of the main chain, the headers are moved to the main chain state. Using multiple transactions, it is possible to modify the committed blocks of the fork chain. However, the current implementation does not remove old committed blocks from storage, nor does it have any checks to prevent these blocks from being used to add more blocks to the chain. This leads to invalid block transitions allowing an invalid long fork to be merged into the main chain.

Lowunnecessary caller checkFixed

The report gives no description here.

Lowvariable shadowingFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (27)

  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/btc_relay/src/structs.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/btc_relay/src/lib.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/spv_swap_vault/src/utils.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/erc20_utils/src/lib.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/escrow_manager/src/components/reputation.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/escrow_manager/src/state.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/btc_relay/src/constants.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/btc_utils/src/bitcoin_tx.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/escrow_manager/src/components.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/btc_utils/src/lib.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/btc_utils/src/bitcoin_merkle_tree.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/escrow_manager/src/lib.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/escrow_manager/src/components/lp_vault.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/src/lib.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/escrow_manager/src/events.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/spv_swap_vault/src/state.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/escrow_manager/src/sighash.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/escrow_manager/src/structs.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/spv_swap_vault/src/events.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/spv_swap_vault/src/lib.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/btc_relay/src/utils.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/spv_swap_vault/src/structs.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/escrow_manager/src/utils.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/btc_relay/src/state.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/btc_utils/src/compact_size.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/escrow_manager/src/components/escrow_storage.cairo at commit 50596c81bae561a1ebc161c362221800d7429396
  • https://github.com/atomiqlabs/atomiq-contracts-starknet/packages/btc_utils/src/byte_array.cairo at commit 50596c81bae561a1ebc161c362221800d7429396

Part of Atomiq Exchange’s security record

Atomiq Exchange
Audits3 audits by 2 firmsLast audit Jul 2025, by Cairo Security Clan.
Critical findingsNo open critical findingsAcross the 3 reports, 3 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Atomiq Exchange’s security record

Security firm

Cairo Security Clan

13 projects reviewed · 21 reports · latest Sep 2025

See Cairo Security Clan’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us