Push Chain security record
As of 31 Oct 2026, Push Chain has 3 audit reports by 1 security firm on Trustblock; the latest is by Hacken, dated 4 Aug 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Push Chain / EVM Gateway | Security firm: Hacken | Date: | Scope: Repository at commit 0928967 | No open critical findings | Open · hacken.io |
| Push Chain / SVM Gateway | Security firm: Hacken | Date: | Scope: Files named in the report | No open critical findings | Open · hacken.io |
| Push Chain / Core Contracts | Security firm: Hacken | Date: | Scope: Repository at commit 15b7054 | No open critical findings | Open · hacken.io |
Findings106
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 2 | 3 | 12 |
| Low | 10 | 11 | 65 |
MediumInconsistent Recipient Semantics Between Documentation and Funds Event EmissionPush Chain / EVM Gateway · Hacken · 4 Aug 2026Acknowledged
The report gives no description here.
Open the reportMediumrescueFundsOnSourceChain Lacks Replay Protection and universalTxId–Token BindingPush Chain / EVM Gateway · Hacken · 4 Aug 2026Acknowledged
The report gives no description here.
Open the reportMediumMissing Per-Slot USD Cap in FUNDS Route Leads To Uncontrolled Deposit ThroughputPush Chain / SVM Gateway · Hacken · 24 Apr 2026Acknowledged
The report gives no description here.
Open the reportLowDuplicate Logic in revertUniversalTx and rescueFunds Increases Maintenance RiskPush Chain / EVM Gateway · Hacken · 4 Aug 2026Acknowledged
The report gives no description here.
Open the reportLowMissing Event Emissions for Critical Admin Configuration ChangesPush Chain / EVM Gateway · Hacken · 4 Aug 2026Acknowledged
The report gives no description here.
Open the reportLowNative FUNDS Route Does Not Support Gas Top-Up BatchingPush Chain / EVM Gateway · Hacken · 4 Aug 2026Acknowledged
The report gives no description here.
Open the reportLowRefund to Non-Receiving Contract Can Revert and Block Entire Outbound TransactionPush Chain / EVM Gateway · Hacken · 4 Aug 2026Acknowledged
The report gives no description here.
Open the reportLowMisleading Function and Parameter Naming in Instant Route HandlerPush Chain / SVM Gateway · Hacken · 24 Apr 2026Acknowledged
The report gives no description here.
Open the reportLowCEA Multicall Does Not Enforce Aggregate Value BoundsPush Chain / Core Contracts · Hacken · 13 Apr 2026Acknowledged
The report gives no description here.
Open the reportLowchainHeightByChainNamespace Is Stored but UnusedPush Chain / Core Contracts · Hacken · 13 Apr 2026Acknowledged
The report gives no description here.
Open the reportShow 4 more
LowGas Inefficiency Due To Dynamic String Mapping KeysPush Chain / Core Contracts · Hacken · 13 Apr 2026Acknowledged
The report gives no description here.
Open the reportLowLeading-Zero Chain IDs Create Ambiguous Numeric InterpretationPush Chain / Core Contracts · Hacken · 13 Apr 2026Acknowledged
The report gives no description here.
Open the reportLowUEA migration can be triggered by UNIVERSAL_EXECUTOR_MODULE without user signature/consentPush Chain / Core Contracts · Hacken · 13 Apr 2026Acknowledged
The report gives no description here.
Open the reportLowVerificationType field is signed but never enforced on-chainPush Chain / Core Contracts · Hacken · 13 Apr 2026Acknowledged
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="push-protocol"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us