Across Protocol security record

Ethereum, Polygon (POS), Arbitrumacross.to X GitHub

As of 2 Jun 2025, Trustblock’s record for Across Protocol holds 15 audit reports by 1 audit firm (May 2022 to May 2025). The latest audit is “Across Protocol Diff Audit -Arbitrum CustomGasToke” by OpenZeppelin, dated 12 May 2025. Those reports list no open critical findings.

Critical findings

No open critical findings

Across the 15 reports, 4 critical findings were reported. Each is marked fixed by the firm that reported it. See the findings

Open the latest report Get the label for your site

Record last updated 2 Jun 2025. It holds audits, findings and contracts up to Oct 2026, and incidents up to Sep 2026. Statuses are the audit firms’ own. Trustblock does not review code.

Audits: 15; by 1 firm, May 2022 to May 2025
Last audit: 12 May 2025; by OpenZeppelin
Audit firms: 1; OpenZeppelin

Issues (91)

	Low	Medium	High	Critical	Total
Not fixed	5	1	2	-	8
Acknowledged	11	3	-	-	14
Fixed	44	18	3	4	69
Total	60	22	5	4	91

Audits (15)

#	Name	Auditor	Date	Chains	Issues
1	Across Protocol Diff Audit -Arbitrum CustomGasToke	OpenZeppelin	2025/05/12	Multi-Chain	No open critical findings
2	Across Audit	OpenZeppelin	2025/05/12	Multi-Chain	No open critical findings
3	SVM Spoke Audit	OpenZeppelin	2025/05/12	Multi-Chain	No open critical findings
4	Across Protocol SVM Solidity Audit	OpenZeppelin	2025/05/12	Multi-Chain	No open critical findings
5	Across Linea CCTP Diff Audit	OpenZeppelin	2025/05/12	Multi-Chain	No open critical findings
6	EVM Universal Adapter Audit	OpenZeppelin	2025/05/12	Multi-Chain	No open critical findings
7	SVM Spoke Incremental Audit	OpenZeppelin	2025/05/12	Multi-Chain	No open critical findings
8	SP1 Helios Audit	OpenZeppelin	2025/05/12	Multi-Chain	No open critical findings
9	Across V3 and Oval Incremental Audit	OpenZeppelin	2024/07/16	Multi-Chain	No open critical findings
10	UMA Accelerating Distributor Incremental Audit	OpenZeppelin	2024/01/29	Multi-Chain	No open critical findings

Contracts (123)

#	Github Repository	Commit Hash	File	Url
1	across-protocol/sp1-helios	6d554b98ce5c72d3931d6a6e7073767882df3e91	script/src/lib.rs	Check on Github
2	across-protocol/sp1-helios	6d554b98ce5c72d3931d6a6e7073767882df3e91	contracts/src/SP1Helios.sol	Check on Github
3	across-protocol/sp1-helios	6d554b98ce5c72d3931d6a6e7073767882df3e91	primitives/src/lib.rs	Check on Github
4	across-protocol/sp1-helios	6d554b98ce5c72d3931d6a6e7073767882df3e91	program/src/main.rs	Check on Github
5	across-protocol/sp1-helios	6d554b98ce5c72d3931d6a6e7073767882df3e91	primitives/src/types.rs	Check on Github
6	across-protocol/contracts	71e990b3f908ecf994be8723e041b584c7d49318	contracts/interfaces/SpokePoolMessageHandler.sol	Check on Github
7	across-protocol/contracts	71e990b3f908ecf994be8723e041b584c7d49318	programs/svm-spoke/src/utils/message_utils.rs	Check on Github
8	across-protocol/contracts	71e990b3f908ecf994be8723e041b584c7d49318	programs/svm-spoke/src/utils/transfer_utils.rs	Check on Github
9	across-protocol/contracts	71e990b3f908ecf994be8723e041b584c7d49318	programs/svm-spoke/src/instructions/deposit.rs	Check on Github
10	across-protocol/contracts	71e990b3f908ecf994be8723e041b584c7d49318	programs/svm-spoke/src/lib.rs	Check on Github

...

Get your label

Is this your project? Add a free label to your website. It shows the audits published on Trustblock, with the latest firm and date, and links to this page. It updates by itself.

HTML

<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
<div
  data-tb-project-widget
  data-tb-project-slug="across-protocol"
  data-tb-variant="label"
  data-tb-color="light"
></div>

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us

#	Github Repository	Commit Hash	File	Url
1	across-protocol/sp1-helios	6d554b98ce5c72d3931d6a6e7073767882df3e91	script/src/lib.rs	Check on Github
2	across-protocol/sp1-helios	6d554b98ce5c72d3931d6a6e7073767882df3e91	contracts/src/SP1Helios.sol	Check on Github
3	across-protocol/sp1-helios	6d554b98ce5c72d3931d6a6e7073767882df3e91	primitives/src/lib.rs	Check on Github
4	across-protocol/sp1-helios	6d554b98ce5c72d3931d6a6e7073767882df3e91	program/src/main.rs	Check on Github
5	across-protocol/sp1-helios	6d554b98ce5c72d3931d6a6e7073767882df3e91	primitives/src/types.rs	Check on Github
6	across-protocol/contracts	71e990b3f908ecf994be8723e041b584c7d49318	contracts/interfaces/SpokePoolMessageHandler.sol	Check on Github
7	across-protocol/contracts	71e990b3f908ecf994be8723e041b584c7d49318	programs/svm-spoke/src/utils/message_utils.rs	Check on Github
8	across-protocol/contracts	71e990b3f908ecf994be8723e041b584c7d49318	programs/svm-spoke/src/utils/transfer_utils.rs	Check on Github
9	across-protocol/contracts	71e990b3f908ecf994be8723e041b584c7d49318	programs/svm-spoke/src/instructions/deposit.rs	Check on Github
10	across-protocol/contracts	71e990b3f908ecf994be8723e041b584c7d49318	programs/svm-spoke/src/lib.rs	Check on Github

...

Across Protocol security record

Issues (91)

Exploitation of Cost Asymmetries Across Chains to Impose High Gas Costs on Refund Executionnot_fixed/high

Forced Use of Claim Accounts for All Relayers in Certain Scenariosnot_fixed/high

Inefficient PDA Derivation in handle_v3_across_messagenot_fixed/low

Missing SpeedUpV3Deposit and FillV3RelayWithUpdatedDeposit Functionalities in SVM Spoke Poolnot_fixed/low

Check For CCTP Version Is Not Fully Reliablenot_fixed/low

Audits (15)

Contracts (123)

Get your label

Audits (15)