Dexalot security record
As of 3 Nov 2026, Dexalot has 3 audit reports by 1 security firm on Trustblock; the latest is by Hacken, dated 21 Apr 2026. Those reports list no open critical findings. It also holds 1 deployed contract on 1 chain.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Dexalot / Bridge | Security firm: Hacken | Date: | Scope: 1 address on Avalanche | 1 critical finding, fixed | Open · hacken.io |
| Dexalot / Solana | Security firm: Hacken | Date: | Scope: 1 address on Avalanche | 1 critical finding, fixed | Open · hacken.io |
| Dexalot / DEX + Bridge | Security firm: Hacken | Date: | Scope: 1 address on Avalanche | No open critical findings | Open · hacken.io |
Findings75
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 4 |
| Medium | 1 | 0 | 9 |
| Low | 15 | 3 | 41 |
CriticalInverted isDirect Flag Logic Causes ERC20 Tokens to Not Be Collected in Direct SwapsDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportCritical[DualDefense] Arbitrary Admin Role Claim Through Account Initialization OrderingDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportHigh[DualDefense] Critical Token‑Confusion VulnerabilityDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportHigh[DualDefense] Dest‑Trader Account not Bound to Order Dest_Trader FieldDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportHigh[DualDefense] Missing Validation Allows Theft of Queued Swap TokensDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportHighArbitrary Funds Destination due to Lack of Accounts Validation in LzReceiveDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportMediumAuction Mode Bypass in bulkTransferTokens Allows Transfers During Active AuctionsDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportMediumdepositTokenFromContract Cannot Pay Bridge FeesDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportMediumFront-Running DoS on Batch Settlement via Rolling Hash InvalidationDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportMediumMissing Gas Tank Auto-Fill for Recipients in Bulk TransfersDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportShow 10 more
Medium[DualDefense] Partial Swaps are not Accounted for Leading to Loss of Takers FundsDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportMedium[DualDefense] Portfolio Lamports DrainDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportMediumArbitrary LayerZero Endpoint ProgramDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportMediumPause Functionality Implemented PartiallyDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportMediumSupported Tokens List Functionality Implemented PartiallyDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportLow[DualDefense] Current Design Allows for maxPerDeposit To Be Bypassed via Same tokenIds in requestDepositDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLow[DualDefense] Duplicate-Heavy Deposit Batches Are Atomic, Cannot Be Partially Settled, and Block Follower BatchesDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLow[DualDefense] finalizeBatch Can Never Finalize Batch Zero Because It Reads batchId - 1 Before The Zero-Batch GuardDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowcalculateWithdrawalFee Returns Zero Fee for Zero Inventory Instead of RevertingDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowDefensive Check Ordering in _calcSharesToMint Allows Theoretical Division by ZeroDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportShow 10 more
LowDivision by Zero When Withdrawing Total Remaining InventoryDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowExcess Native Token Not Refunded When User Pays Bridge FeeDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowFirst Batch Vulnerable to Immediate UnwindDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowGas Inefficiency in powMultipleOf4BPSDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowInconsistent Documentation for Default Allowed Slippage PercentDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowInconsistent Native Token Handling in sendTokenBalance FunctionDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowInverted NatSpec Comment in _updateTakerFeeCollectorDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowK Value Not Validated as Multiple of 4 Causes Incorrect Fee CalculationDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowMisleading Documentation and Dead Code in floor FunctionDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowMisleading NatSpec Comment in powMultipleOf4BPS FunctionDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportShow 10 more
LowMissing Explicit Check for Maximum Token Limit Results in Overflow RevertDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowMissing msg.value Validation for Native Token SwapsDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowMissing NatSpec Documentation for Function Parameters in PortfolioSubDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowMissing Reentrancy Guards on Swap Functions Reduces Defense-in-DepthDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowMissing Token Validation in Withdrawal Settlement Allows Arbitrary Asset DispatchDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowMissing tokenType Validation Allows Irreversible Token InvalidationDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowMissing Validation for Duplicate and Empty Token SymbolsDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowNative Tokens Lost During ERC20 Swaps Through RouterDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowNo Mechanism to Remove Whitelisted Functions in OmniVaultExecutorDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowOff-by-One Error in PortfolioBridgeMain Contract Balance CheckDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportShow 10 more
Lowreceive Function in DexalotRouter Accepts ETH Without Processing, Leading to Stuck FundsDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowRedundant Conditional Logic in decrement FunctionDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowSilent Failure in matchAuctionOrder Causes Infinite Loop in matchAuctionOrdersDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowSwitching to bulkTransferTokens Removes AutoFill Functionality for Claim RecipientsDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowUndocumented Zero Parameters in getNativeBridgeFeeDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowUnrestricted Share Minting by Settler Role Enables Value Extraction from DepositorsDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowUnrestricted Withdrawal Amounts by Settler Role Enables Value Extraction from Withdrawing UsersDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowUse of Deprecated transfer Function for Native Token WithdrawalDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowVault Status Management Allows Setting NONE/DEPRECATED Status, Locking User FundsDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportLowWhitelisted Function Selector Mapping May Silently Overwrite Existing EntriesDexalot / Bridge · Hacken · 21 Apr 2026Fixed
The report gives no description here.
Open the reportShow 6 more
LowFloating Toolchain VersionDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportLowInconsistent Deposit Pause FunctionalityDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportLowRedundant Account InitializationsDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportLowRedundant Bumps RecalculationDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportLowRedundant Getter InstructionDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportLowRedundant Portfolio PDA FieldsDexalot / Solana · Hacken · 29 Aug 2025Fixed
The report gives no description here.
Open the reportContracts1
| Address | Chain | Source code |
|---|---|---|
| 0x093783055f9047c2bff99c4e414501f8a147bc69 | Chain: Avalanche | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="dexalot"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us