Push Chain security record

Ethereum, Polygon (POS)push.org

As of 31 Oct 2026, Push Chain has 3 audit reports by 1 security firm on Trustblock; the latest is by Hacken, dated 4 Aug 2026. Those reports list no open critical findings.

Critical findings
No open critical findings
Across 3 reports.
Open the latest report
Your label, live
Get the label for your site

Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.

Audits3

Newest first

AuditSecurity firmDateScopeCritical findingsReport
Push Chain / EVM Gateway

Audit

Security firm: HackenDate: Scope: Repository at commit 0928967No open critical findingsOpen · hacken.io
Push Chain / SVM Gateway

Audit

Security firm: HackenDate: Scope: Files named in the reportNo open critical findingsOpen · hacken.io
Push Chain / Core Contracts

Audit

Security firm: HackenDate: Scope: Repository at commit 15b7054No open critical findingsOpen · hacken.io

Findings106

Statuses are the security firm’s own, from each report.

SeverityOpenAcknowledgedFixed
Critical000
High003
Medium2312
Low101165
HighFee-on-Transfer ERC20 Tokens Cause Vault Insolvency and Permanent Fund Lock in Revert/Rescue PathsPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
HighUniversalGatewayPC Relies on IUniversalCore.BASE_GAS_LIMIT(), but UniversalCore Does Not Implement ItPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
HighERC-20 Return Path Missing Token Approval Despite Documentation RequirementPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
Medium_burnPRC20 Ignores transferFrom Return Value, Allowing Silent Transfer FailurePush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
MediumDocumentation and Implementation Mismatch in Token Support ValidationPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
MediumInconsistent Role Management Causes State and Role MismatchPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
Medium[Dual Defense] Missing Post-CPI Validation Allows a Destination Program to Persist Authority Mutations on the CEA and Its ATAPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
MediumInconsistent Pause Constraints Across Admin FunctionsPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
MediumInsufficient Privilege Separation in PauseAction Allows Pauser to Unpause the GatewayPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
MediumMissing Canonical ATA Enforcement on Vault Token Accounts Causes SPL Liquidity FragmentationPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
Show 10 more
MediumUnsigned revert_msg Allows Forged Revert Data in Cross-Chain EventsPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
MediumCEA Migration Path Does Not Enforce Self-Targeting SemanticsPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
MediumdefaultDeadlineMins Default Value Is Not Initialized in Proxy StoragePush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
MediumDomain Separator Omits Push Chain Network Identifier, Enabling Cross-Deployment Signature ReplayPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
MediumSVM Domain Separator Encodes chainId Incorrectly Relative to EIP-712Push Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowAbsence of Granular Role SeparationPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowDead WETH Branch in _findV3PoolWithNativePush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowETH Permanently Locked in Gateway on ERC20 Revert/Rescue Due to Missing msg.value ValidationPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowInconsistent Function Naming vs Visibility ConventionPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowInconsistent State Variable Ordering in UniversalGatewayPC Reduces Upgradeability ClarityPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
Show 10 more
Lowinitialize Silently Skips Uniswap Configuration If Only One Address Is ZeroPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowIUniversalGateway.UniversalTxExecuted Is Declared but Never EmittedPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowMisleading Function Name setRoutersPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowMisleading TSS Control Description in UniversalGateway DocumentationPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowMissing Rescue Gas Limit Controls in UniversalGatewayPC ImplementationPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
Lowmsg.value Is Permanently Trapped in sendUniversalTx(UniversalTokenTxRequest)Push Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowMutable State Variables Are Named Like ConstantsPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowPer-Block USD Cap Uses Mixed-Price Accounting Within the Same BlockPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowRedundant Deadline Validation in Token-Gas FlowPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowRedundant else if Branch in _sendTxWithFundsPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
Show 10 more
LowRedundant Initializable and ContextUpgradeable InheritancePush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowRedundant TSS_ROLE Management (Role Not Used for Authorization)Push Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowsetChainlinkStalePeriod(0) Disables Oracle Freshness ValidationPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowTransaction Type Is Inferred Before Fee Deduction, Causing Post-Fee Route MismatchPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowUnbounded setProtocolFee Allows Arbitrary Fee ConfigurationPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowUniversalGatewayPC Lacks an Admin Setter for UNIVERSAL_COREPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowUnreachable else Branch in _routeUniversalTxPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowVaultPC Withdraw Events Omit Recipient AddressPush Chain / EVM Gateway · Hacken · 4 Aug 2026Fixed

The report gives no description here.

Open the report
LowDead Code in send_tx_with_gas_route Zero-Amount GuardPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
LowExcessive Pyth Oracle Staleness Window Enables Rate Limit BypassPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
Show 10 more
LowLack of Two-Step Admin TransferPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
Lowlimit_threshold = 0 Causes Token-Level DoS Instead of Disabling Rate LimitingPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
LowMissing Mint Authority Validation in set_token_rate_limit Allows Whitelisting Tokens with Unsafe AuthoritiesPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
LowPDA Bumps Re-derived Instead of Using Stored Values in Finalize InstructionPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
LowRate Limiting Scope Is Not Documented in the Threat ModelPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
LowRedundant Oracle Price Calculation in Gas Route DepositPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
LowRedundant Payload Validation in Funds Route HandlerPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
Lowset_token_rate_limit Unconditionally Resets Epoch Usage on Threshold UpdatePush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
LowUnprotected Initialization Allows First-Caller TakeoverPush Chain / SVM Gateway · Hacken · 24 Apr 2026Fixed

The report gives no description here.

Open the report
LowAbsence of Granular Role SeparationPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
Show 10 more
LowCEA Multicall Discards Underlying Revert ReasonsPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowCustom Errors Can Be Used for Gas EfficiencyPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowDeposit Event Misreports the Effective Mint CallerPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowEmpty Revert Messages in WPC Reduce Failure ObservabilityPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowGas Token Updates Do Not Invalidate Chain Gas Price ConfigurationPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowgetOriginForUEA Returns Synthetic Identity With Hardcoded Push Chain IDPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowInconsistent Zero-Value Handling for Base and Rescue Gas LimitsPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowinitializeCEA Arguments Differ From Documented SpecificationPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowMissing Events for Critical Admin Configuration ChangesPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowMissing Reentrancy Guard on depositPRC20TokenPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
Show 10 more
LowPC Can Become Permanently Stuck Due to Missing Rescue PathPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowPRC20 Direct Mint Path Bypasses UniversalCore PausePush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowProxy Initialization Validation Is Inconsistent Between CEAProxy and UEAProxyPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowRedundant Role Check in Batch Registration Increases Gas CostsPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowregisterUEA Can Overwrite Existing VM Implementation MappingPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowReturn Values from IPRC20.deposit and IPRC20.approve Are IgnoredPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowRole Management Surface for PAUSER_ROLE Is Inconsistent and Potentially MisleadingPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowSafeERC20 Is Imported but Never Used in CEAPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowsetChainMeta Allows Zero Gas Price, Causing Quote Path DoSPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowsetDefaultFeeTier Rejects Valid Uniswap V3 1 bps Fee TierPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
Show 10 more
LowslippageTolerance Is Configurable but Never EnforcedPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowtotalSupply in WPC Can Be Inflated by Force-Sent Native PCPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowtransferFrom in PRC20 Performs Balance Transfer Before Allowance ValidationPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowuniswapV3Quoter Is Stored but Never UsedPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowUniversalCore Documentation Is Out of Sync With ImplementationPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowUnused isSupportedToken Gate Allows Configuration DriftPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowUnused SafeERC20 Import and Inconsistent ERC-20 HandlingPush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowUse of Magic Numbers Reduces Clarity and Increases Maintenance Risk in UniversalCorePush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowWPC.withdraw Uses .transfer (2300 Gas Limit)Push Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report
LowZero baseGasLimit Can Produce Zero Gas Fee QuotePush Chain / Core Contracts · Hacken · 13 Apr 2026Fixed

The report gives no description here.

Open the report

Contracts

No deployed address is recorded for these audits.

The reports name a repository or files. Open a report to see its scope.

The repositories and files the reports name

Show this on your site

Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.

Content

Facts

Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.

Fixed as
Language

Style

Layout
Theme
Accent
Corners

Format

Size
Date
Embed as
HTML
<head>
	<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
</head>
<body>
	<div
		data-tb-project-widget
		data-tb-project-slug="push-protocol"
	></div>
</body>

Paste the code where the label should appear. It uses no API credit and updates by itself.

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us