Atomiq Exchange security record
As of 31 Oct 2026, Atomiq Exchange has 3 audit reports by 2 security firms on Trustblock; the latest is by Cairo Security Clan, dated 25 Jul 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| atomiq.exchange security review | Security firm: Cairo Security Clan | Date: | Scope: Files named in the report | No open critical findings | Open · IPFS |
| security review atomiq.exchange | Security firm: Cairo Security Clan | Date: | Scope: Repository at commit 50596c8 | No open critical findings | Open · IPFS |
| Sollightning | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | 3 critical findings, fixed | Open · GitHub |
Findings28
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 3 |
| High | 1 | 0 | 3 |
| Medium | 2 | 2 | 3 |
| Low | 7 | 0 | 7 |
CriticalInitializer can lose refundable feeSollightning · Ackee Blockchain Security · 12 Jan 2024Fixed
The report gives no description here.
Open the reportCriticalPossibility to lock fundsSollightning · Ackee Blockchain Security · 12 Jan 2024Fixed
The report gives no description here.
Open the reportCriticalTransaction hash uniqueness not guaranteedSollightning · Ackee Blockchain Security · 12 Jan 2024Fixed
The report gives no description here.
Open the reportHighfront-running issue in executioncontract.create allows blocking of legitimate spvswapvault transactionsatomiq.exchange security review · Cairo Security Clan · 25 Jul 2025Fixed
The executioncontract.create function is permissionless and allows anyone to create an execution commitment for any owner with any salt. Attackers can frontrun legitimate transactions by calling create with the same parameters, causing those transactions to revert with a "create already initiated" error, blocking users from accessing their funds.
Open the reportHighchain re-org could occur when a long fork is constructedsecurity review atomiq.exchange · Cairo Security Clan · 7 Apr 2025Fixed
In the btc_relay package, the process of submitting fork blockheaders for large forks (≥ 25 blocks) does not verify whether the block at fork_start_blockheight is still committed to the main chain when comparing forks' chain work. This can lead to a fork overtaking the main chain incorrectly if the main chain has been overtaken by a different fork replacing that block.
Open the reportHighinvalid long fork could be mergedsecurity review atomiq.exchange · Cairo Security Clan · 7 Apr 2025Fixed
In the btc_relay package, when a fork occurs on the bitcoin main chain, the program allows anyone to submit fork blockheaders. These headers are automatically added to the main chain if their chain work surpasses that of the current main chain. For large forks (≥ 25 blocks), block headers are submitted across multiple transactions. The block headers are temporarily stored on-chain, and when the fork's chain work exceeds that of the main chain, the headers are moved to the main chain state. Using multiple transactions, it is possible to modify the committed blocks of the fork chain. However, the current implementation does not remove old committed blocks from storage, nor does it have any checks to prevent these blocks from being used to add more blocks to the chain. This leads to invalid block transitions allowing an invalid long fork to be merged into the main chain.
Open the reportMediumattacker can intentionally limit gas to sabotage the success action executionatomiq.exchange security review · Cairo Security Clan · 25 Jul 2025Fixed
The report gives no description here.
Open the reportMediumNumber of confirmations not limitedSollightning · Ackee Blockchain Security · 12 Jan 2024Fixed
The report gives no description here.
Open the reportMediumUnchecked token accountSollightning · Ackee Blockchain Security · 12 Jan 2024Fixed
The report gives no description here.
Open the reportLowmisleading parameter name src in _payout functionatomiq.exchange security review · Cairo Security Clan · 25 Jul 2025Fixed
The report gives no description here.
Open the reportShow 6 more
Lowunnecessary caller checksecurity review atomiq.exchange · Cairo Security Clan · 7 Apr 2025Fixed
The report gives no description here.
Open the reportLowvariable shadowingsecurity review atomiq.exchange · Cairo Security Clan · 7 Apr 2025Fixed
The report gives no description here.
Open the reportLowAccount does not need to be mutableSollightning · Ackee Blockchain Security · 12 Jan 2024Fixed
The report gives no description here.
Open the reportLowBump calculationSollightning · Ackee Blockchain Security · 12 Jan 2024Fixed
The report gives no description here.
Open the reportLowPassing Rent SysVarSollightning · Ackee Blockchain Security · 12 Jan 2024Fixed
The report gives no description here.
Open the reportLowUnused instruction parametersSollightning · Ackee Blockchain Security · 12 Jan 2024Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="atomiq-exchange"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us