Across Protocol security record
As of 30 Oct 2026, Across Protocol has 15 audit reports by 1 security firm on Trustblock; the latest is by OpenZeppelin, dated 12 May 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits15
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Across Protocol Diff Audit -Arbitrum CustomGasToke | Security firm: OpenZeppelin | Date: | Scope: Repository at commit f56146a | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| Across Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 5a0c67c | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| SVM Spoke Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 401e24c | No open critical findings | Open · blog.openzeppelin.com |
| Across Protocol SVM Solidity Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 7f0cedb | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| Across Linea CCTP Diff Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit e5310e0 | No open critical findings | Open · blog.openzeppelin.com |
| EVM Universal Adapter Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 9b58d8e | No open critical findings | Open · blog.openzeppelin.com |
| SVM Spoke Incremental Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 71e990b | No open critical findings | Open · blog.openzeppelin.com |
| SP1 Helios Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 6d554b9 | No open critical findings | Open · blog.openzeppelin.com |
| Across V3 and Oval Incremental Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| UMA Accelerating Distributor Incremental Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Across V2 Incremental Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| UMA Across V2 Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Across Token and Token Distributor Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| UMA Across V2 Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| UMA Across V2 Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
Findings91
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 4 |
| High | 2 | 0 | 3 |
| Medium | 1 | 3 | 18 |
| Low | 5 | 11 | 44 |
CriticalWrong Scaling for Amount of Gas TokensAcross Protocol Diff Audit -Arbitrum CustomGasToke · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportCriticalMissing Access Control for setDestinationSettlerAcross Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportCriticalAnyone Can Lock Relayer Refunds and Contract Can Be DrainedAcross Protocol SVM Solidity Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportCriticalSlow relays on multiple chainsUMA Across V2 Audit · OpenZeppelin · 11 May 2022Fixed
The report gives no description here.
Open the reportHighForwarder and Withdrawal Helper Contracts Do Not Handle ETH Transfers CorrectlyAcross Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportHighSpokePool's fill Function Performs Malformed CallAcross Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportHighAnyone can prevent stakers from getting their rewardsAcross Token and Token Distributor Audit · OpenZeppelin · 21 Jul 2022Fixed
The report gives no description here.
Open the reportMediumAttempts to Bridge WETH Using ZkStack_CustomGasToken_Adapter Will FailAcross Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumGriefing Attacks Are Possible in ZK AdaptersAcross Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumIncorrect Parameters Passed to permitWitnessTransferFromAcross Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportShow 10 more
MediumNo Way to Invoke Some Privileged Functions of ForwardersAcross Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumrelayTokens Calls Made By Forwarders May FailAcross Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumSome Contracts Might Not Work Properly with USDT AllowanceAcross Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumTransfers of The Target Chain's Gas Token Will FailAcross Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumTypes Incompatible With ERC-7683Across Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportMediumDeposit Tokens Transferred from Depositor Token Account Instead of SignerSVM Spoke Incremental Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportMedium[Across] It Will Not Be Possible to Bridge DAI to BlastAcross V3 and Oval Incremental Audit · OpenZeppelin · 16 Jul 2024Fixed
The report gives no description here.
Open the reportMedium[Oval] Attempts to Push Price to the CoinbaseOracle Will Always FailAcross V3 and Oval Incremental Audit · OpenZeppelin · 16 Jul 2024Fixed
The report gives no description here.
Open the reportMedium[Oval] Newest Prices May Be Reported Ignoring the lockWindow() ConstraintAcross V3 and Oval Incremental Audit · OpenZeppelin · 16 Jul 2024Fixed
The report gives no description here.
Open the reportMedium[Oval] Updating Parameters Inside the BaseController Contract May Lead to Undesired OutcomesAcross V3 and Oval Incremental Audit · OpenZeppelin · 16 Jul 2024Fixed
The report gives no description here.
Open the reportShow 10 more
MediumHubPool Might Stop Executing Bundles if Deposit Limits Are Enabled for ZkSyncAcross V2 Incremental Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportMediumLack of input validationAcross Token and Token Distributor Audit · OpenZeppelin · 21 Jul 2022Fixed
The report gives no description here.
Open the reportMediumConfusing removeLiquidity behavior could lock fundsUMA Across V2 Audit · OpenZeppelin · 11 May 2022Fixed
The report gives no description here.
Open the reportMediumInconsistent signature checkingUMA Across V2 Audit · OpenZeppelin · 11 May 2022Fixed
The report gives no description here.
Open the reportMediumwhitelistedRoutes for Ethereum_SpokePool affect other routesUMA Across V2 Audit · OpenZeppelin · 11 May 2022Fixed
The report gives no description here.
Open the reportLowMissing DocstringsAcross Protocol Diff Audit -Arbitrum CustomGasToke · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportLowReplace require Statements with Custom ErrorsAcross Protocol Diff Audit -Arbitrum CustomGasToke · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportLowChanging crossDomainAdmin Will Prohibit Pending OperationsAcross Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportLowIncorrect CastsAcross Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportLowinstruction_params Account Remains Open After ExecutionSVM Spoke Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowLack of Event EmissionSVM Spoke Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportLowUnnecessary Use of InitSpace MacroSVM Spoke Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportLow_destinationSettler Can Return Zero AddressAcross Protocol SVM Solidity Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportLowFunction Can Be Declared externalAcross Protocol SVM Solidity Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportLowIncorrect Right Shift in AddressConverters LibraryAcross Protocol SVM Solidity Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportLowRepeated FunctionAcross Protocol SVM Solidity Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportLowInsufficient DocumentationAcross Linea CCTP Diff Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportLowUnclear Vault Initialization ProcessSVM Spoke Incremental Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportLowMisleading DocumentationSP1 Helios Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportLowSuperfluous Update of Role AdminSP1 Helios Audit · OpenZeppelin · 12 May 2025Fixed
The report gives no description here.
Open the reportShow 10 more
Low[Across] Blast_SpokePool May Fail on Attempt to Bridge Native Blast TokensAcross V3 and Oval Incremental Audit · OpenZeppelin · 16 Jul 2024Fixed
The report gives no description here.
Open the reportLow[Across] Error-Prone Initialization of Blast_Adapter.solAcross V3 and Oval Incremental Audit · OpenZeppelin · 16 Jul 2024Fixed
The report gives no description here.
Open the reportLow[Across] Permit2 Witness Is Not Fully Compliant With EIP-712Across V3 and Oval Incremental Audit · OpenZeppelin · 16 Jul 2024Fixed
The report gives no description here.
Open the reportLow[Across] Users May Lose Assets if They Specify an Empty Address as a Call TargetAcross V3 and Oval Incremental Audit · OpenZeppelin · 16 Jul 2024Fixed
The report gives no description here.
Open the reportLow[Oval] CoinbaseSourceAdapter May Return Old PricesAcross V3 and Oval Incremental Audit · OpenZeppelin · 16 Jul 2024Fixed
The report gives no description here.
Open the reportLow[Oval] Missing Input ValidationAcross V3 and Oval Incremental Audit · OpenZeppelin · 16 Jul 2024Fixed
The report gives no description here.
Open the reportLow[Oval] PermissionProxy.execute Will Fail if Non-Zero value Is ProvidedAcross V3 and Oval Incremental Audit · OpenZeppelin · 16 Jul 2024Fixed
The report gives no description here.
Open the reportLowLack of input validationUMA Accelerating Distributor Incremental Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowMissing or incomplete docstringsUMA Accelerating Distributor Incremental Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowPotential underflow errorUMA Accelerating Distributor Incremental Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowIncorrect or misleading documentationUMA Across V2 Audit · OpenZeppelin · 4 Jan 2024Fixed
The report gives no description here.
Open the reportLowLack of event emission after sensitive actionUMA Across V2 Audit · OpenZeppelin · 4 Jan 2024Fixed
The report gives no description here.
Open the reportLowMissing docstringsUMA Across V2 Audit · OpenZeppelin · 4 Jan 2024Fixed
The report gives no description here.
Open the reportLowupdatedRelayerFeePct can be lower than expectedUMA Across V2 Audit · OpenZeppelin · 4 Jan 2024Fixed
The report gives no description here.
Open the reportLowIncomplete and unindexed eventsAcross Token and Token Distributor Audit · OpenZeppelin · 21 Jul 2022Fixed
The report gives no description here.
Open the reportLowRecovery function is not robustAcross Token and Token Distributor Audit · OpenZeppelin · 21 Jul 2022Fixed
The report gives no description here.
Open the reportLowUnhandled failures in token interactionsAcross Token and Token Distributor Audit · OpenZeppelin · 21 Jul 2022Fixed
The report gives no description here.
Open the reportLowUnused inherited contractsAcross Token and Token Distributor Audit · OpenZeppelin · 21 Jul 2022Fixed
The report gives no description here.
Open the reportLowchainId function is not virtualUMA Across V2 Audit · OpenZeppelin · 11 May 2022Fixed
The report gives no description here.
Open the reportLowLack of input validationUMA Across V2 Audit · OpenZeppelin · 11 May 2022Fixed
The report gives no description here.
Open the reportShow 9 more
LowLiquidity provisioning can skew fee assessmentsUMA Across V2 Audit · OpenZeppelin · 11 May 2022Fixed
The report gives no description here.
Open the reportLowNo good way to disable routes in HubPoolUMA Across V2 Audit · OpenZeppelin · 11 May 2022Fixed
The report gives no description here.
Open the reportLowPolygon bridger does not enforce chainId requirementsUMA Across V2 Audit · OpenZeppelin · 11 May 2022Fixed
The report gives no description here.
Open the reportLowSome functions not marked nonReentrantUMA Across V2 Audit · OpenZeppelin · 11 May 2022Fixed
The report gives no description here.
Open the reportLowTime is cast unsafelyUMA Across V2 Audit · OpenZeppelin · 11 May 2022Fixed
The report gives no description here.
Open the reportLowIncorrect or misleading documentationUMA Across V2 Audit · OpenZeppelin · 10 May 2022Fixed
The report gives no description here.
Open the reportLowLack of event emission after sensitive actionUMA Across V2 Audit · OpenZeppelin · 10 May 2022Fixed
The report gives no description here.
Open the reportLowMissing docstringsUMA Across V2 Audit · OpenZeppelin · 10 May 2022Fixed
The report gives no description here.
Open the reportLowupdatedRelayerFeePct can be lower than expectedUMA Across V2 Audit · OpenZeppelin · 10 May 2022Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="across-protocol"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us