Across Protocol security record
As of 30 Oct 2026, Across Protocol has 15 audit reports by 1 security firm on Trustblock; the latest is by OpenZeppelin, dated 12 May 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits15
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Across Protocol Diff Audit -Arbitrum CustomGasToke | Security firm: OpenZeppelin | Date: | Scope: Repository at commit f56146a | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| Across Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 5a0c67c | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| SVM Spoke Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 401e24c | No open critical findings | Open · blog.openzeppelin.com |
| Across Protocol SVM Solidity Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 7f0cedb | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| Across Linea CCTP Diff Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit e5310e0 | No open critical findings | Open · blog.openzeppelin.com |
| EVM Universal Adapter Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 9b58d8e | No open critical findings | Open · blog.openzeppelin.com |
| SVM Spoke Incremental Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 71e990b | No open critical findings | Open · blog.openzeppelin.com |
| SP1 Helios Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 6d554b9 | No open critical findings | Open · blog.openzeppelin.com |
| Across V3 and Oval Incremental Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| UMA Accelerating Distributor Incremental Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Across V2 Incremental Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| UMA Across V2 Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Across Token and Token Distributor Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| UMA Across V2 Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| UMA Across V2 Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
Findings91
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 4 |
| High | 2 | 0 | 3 |
| Medium | 1 | 3 | 18 |
| Low | 5 | 11 | 44 |
MediumOutdated SafeERC20 Contract Does Not Approve to Zero FirstAcross Protocol Diff Audit -Arbitrum CustomGasToke · OpenZeppelin · 12 May 2025Acknowledged
The report gives no description here.
Open the reportMediumOveruse of emit_cpi! Macro for Event LoggingSVM Spoke Audit · OpenZeppelin · 12 May 2025Acknowledged
The report gives no description here.
Open the reportMediumConfiguration update retroactively impacts users rewardsUMA Accelerating Distributor Incremental Audit · OpenZeppelin · 29 Jan 2024Acknowledged
The report gives no description here.
Open the reportLowFloating PragmaAcross Protocol Diff Audit -Arbitrum CustomGasToke · OpenZeppelin · 12 May 2025Acknowledged
The report gives no description here.
Open the reportLowPotential Locked ETH in Arbitrum_CustomGasToken_AdapterAcross Protocol Diff Audit -Arbitrum CustomGasToke · OpenZeppelin · 12 May 2025Acknowledged
The report gives no description here.
Open the reportLowPotentially Mutable Variable Treated as ImmutableAcross Audit · OpenZeppelin · 12 May 2025Acknowledged
The report gives no description here.
Open the reportLowEvents Emitted Without State ChangeSVM Spoke Audit · OpenZeppelin · 12 May 2025Acknowledged
The report gives no description here.
Open the reportLowInconsistent Route Enabling ValidationSVM Spoke Audit · OpenZeppelin · 12 May 2025Acknowledged
The report gives no description here.
Open the reportLowMishandling of Exclusivity Deadline Greater Than 1 YearSVM Spoke Audit · OpenZeppelin · 12 May 2025Acknowledged
The report gives no description here.
Open the reportLowPausing Mechanism May Be Slow in Emergency ScenariosSVM Spoke Audit · OpenZeppelin · 12 May 2025Acknowledged
The report gives no description here.
Open the reportShow 4 more
LowLack of Unit Tests for ERC-7683Across Protocol SVM Solidity Audit · OpenZeppelin · 12 May 2025Acknowledged
The report gives no description here.
Open the reportLowDouble Relay of a rootBundle Is PossibleEVM Universal Adapter Audit · OpenZeppelin · 12 May 2025Acknowledged
The report gives no description here.
Open the reportLowUnverified SOURCE_CHAIN_ID in Universal_SpokePool ConstructorEVM Universal Adapter Audit · OpenZeppelin · 12 May 2025Acknowledged
The report gives no description here.
Open the reportLowSP1Helios Contract Can End Up UnupdatableSP1 Helios Audit · OpenZeppelin · 12 May 2025Acknowledged
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="across-protocol"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us