Push Chain / EVM Gateway

HackenRepository at commit 0928967

Audit

Hacken reviewed Push Chain (Push Chain / EVM Gateway) on 4 Aug 2026: 38 findings, 0 critical; 28 marked fixed, 6 acknowledged, 4 open.

No open critical findings
Open the reportOpen Push Chain’s security record

Report hosted on hacken.io.

Trustblock does not review code.

Findings38

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High002
Medium123
Low3423
HighFee-on-Transfer ERC20 Tokens Cause Vault Insolvency and Permanent Fund Lock in Revert/Rescue PathsFixed

The report gives no description here.

HighUniversalGatewayPC Relies on IUniversalCore.BASE_GAS_LIMIT(), but UniversalCore Does Not Implement ItFixed

The report gives no description here.

Medium_burnPRC20 Ignores transferFrom Return Value, Allowing Silent Transfer FailureFixed

The report gives no description here.

MediumDocumentation and Implementation Mismatch in Token Support ValidationFixed

The report gives no description here.

MediumInconsistent Role Management Causes State and Role MismatchFixed

The report gives no description here.

LowAbsence of Granular Role SeparationFixed

The report gives no description here.

LowDead WETH Branch in _findV3PoolWithNativeFixed

The report gives no description here.

LowETH Permanently Locked in Gateway on ERC20 Revert/Rescue Due to Missing msg.value ValidationFixed

The report gives no description here.

LowInconsistent Function Naming vs Visibility ConventionFixed

The report gives no description here.

LowInconsistent State Variable Ordering in UniversalGatewayPC Reduces Upgradeability ClarityFixed

The report gives no description here.

Show 10 more
Lowinitialize Silently Skips Uniswap Configuration If Only One Address Is ZeroFixed

The report gives no description here.

LowIUniversalGateway.UniversalTxExecuted Is Declared but Never EmittedFixed

The report gives no description here.

LowMisleading Function Name setRoutersFixed

The report gives no description here.

LowMisleading TSS Control Description in UniversalGateway DocumentationFixed

The report gives no description here.

LowMissing Rescue Gas Limit Controls in UniversalGatewayPC ImplementationFixed

The report gives no description here.

Lowmsg.value Is Permanently Trapped in sendUniversalTx(UniversalTokenTxRequest)Fixed

The report gives no description here.

LowMutable State Variables Are Named Like ConstantsFixed

The report gives no description here.

LowPer-Block USD Cap Uses Mixed-Price Accounting Within the Same BlockFixed

The report gives no description here.

LowRedundant Deadline Validation in Token-Gas FlowFixed

The report gives no description here.

LowRedundant else if Branch in _sendTxWithFundsFixed

The report gives no description here.

Show 8 more
LowRedundant Initializable and ContextUpgradeable InheritanceFixed

The report gives no description here.

LowRedundant TSS_ROLE Management (Role Not Used for Authorization)Fixed

The report gives no description here.

LowsetChainlinkStalePeriod(0) Disables Oracle Freshness ValidationFixed

The report gives no description here.

LowTransaction Type Is Inferred Before Fee Deduction, Causing Post-Fee Route MismatchFixed

The report gives no description here.

LowUnbounded setProtocolFee Allows Arbitrary Fee ConfigurationFixed

The report gives no description here.

LowUniversalGatewayPC Lacks an Admin Setter for UNIVERSAL_COREFixed

The report gives no description here.

LowUnreachable else Branch in _routeUniversalTxFixed

The report gives no description here.

LowVaultPC Withdraw Events Omit Recipient AddressFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (24)

  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/test/coverage/src/UEA/UEA_EVM.sol.func.html at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/test/coverage/src/UEAFactoryV1.sol.func-c.html at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/src/libraries/TypesUG.sol at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/src/UniversalGatewayPC.sol at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/test/coverage/src/UEAFactoryV1.sol.func.html at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/src/libraries/Errors.sol at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/test/coverage/src/UniversalGateway.sol.func.html at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/src/Vault.sol at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/test/coverage/src/UEA/UEA_SVM.sol.gcov.html at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/test/coverage/src/UniversalGateway.sol.gcov.html at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/src/interfaces/IVaultPC.sol at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/src/interfaces/IUniversalGateway.sol at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/test/coverage/src/UEA/UEA_SVM.sol.func.html at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/src/interfaces/IVault.sol at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/test/coverage/src/UniversalGateway.sol.func-c.html at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/src/interfaces/IUniversalGatewayPC.sol at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/test/coverage/src/UEA/UEA_EVM.sol.gcov.html at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/test/coverage/src/UEA/UEA_EVM.sol.func-c.html at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/test/coverage/src/UEAFactoryV1.sol.gcov.html at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/src/VaultPC.sol at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/test/coverage/src/UEA/UEA_SVM.sol.func-c.html at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/src/libraries/Types.sol at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/src/libraries/TypesUGPC.sol at commit 0928967cce6cdac2a584340892daf621ff173abd
  • https://github.com/pushchain/push-chain-interop-contracts/contracts/evm-gateway/src/UniversalGateway.sol at commit 0928967cce6cdac2a584340892daf621ff173abd

Part of Push Chain’s security record

Push Chain
Audits3 audits by 1 firmLast audit Aug 2026, by Hacken.
Critical findingsNo open critical findingsAcross 3 reports.
Open Push Chain’s security record

Security firm

Hacken

343 projects reviewed · 476 reports · latest Sep 2026

See Hacken’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us