Persistence Bridge - audit
Audit · firm’s term: security audit
Oak Security reviewed Persistence (Persistence Bridge - audit) on 20 Jan 2022: 18 findings, 6 critical; 15 marked fixed, 3 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings18
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 5 |
| High | 0 | 0 | 3 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 2 | 7 |
CriticalBadgerDB and Ka a operations do not happen atomically, potentially leading inconsistent state and missed bridged transactionsFixed
The report gives no description here.
CriticalLack of Ka a message deduplication can lead to accidental transaction replayFixed
The report gives no description here.
CriticalMnemonic/seed phrase as well as a bearer token exists in the codebaseFixed
The report gives no description here.
CriticalTLS connection to CASP is prone to man-in-the-middle attacksFixed
The report gives no description here.
CriticalUnbonding of all funds will failFixed
The report gives no description here.
HighCASP API token can be read by any user on the machineFixed
The report gives no description here.
HighSigning may failFixed
The report gives no description here.
HighTransaction page calculation using floating point numbers could be off by one, causing transactions to be missedFixed
The report gives no description here.
LowErroneous batch size counting logic will lead to bigger batch sizes than setFixed
The report gives no description here.
LowUnchecked error during initialization and start of chainFixed
The report gives no description here.
Show 5 more
LowUsage of leaking time. Tick will lead the program to run out of memoryFixed
The report gives no description here.
LowUsage of loops for retrying without timeouts may lead to program running out of memory or deadlock on shutdownFixed
The report gives no description here.
LowUsage of magic numbers throughout the codebaseFixed
The report gives no description here.
LowWhen no validator is in database the program does not panicFixed
The report gives no description here.
LowWrong validation before setting Ethereum public key in configurationFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Persistence’s security record
PersistenceSecurity firm
Oak Security33 projects reviewed · 60 reports · latest May 2026
See Oak Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us