Securitize security record
As of 14 Oct 2026, Securitize has 37 audit reports by 2 security firms on Trustblock; the latest is by Cyfrin, dated 17 Sep 2026. Those reports list no open critical findings.
Critical findings
No open critical findings
Across the 37 reports, 6 critical findings were reported. Each is marked fixed by the firm that reported it. See the findings
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits37
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Securitize SVM VaultRegistrar SPL ACL Audit | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize Solana Whitelister Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize EVM GlobalDenyList Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize DSToken Timelocks Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize Tempo TIP-20 Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize EVM Async Vault Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize Bridge ACL Ext Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize MatchHandler Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize ZKsync Exit Bridge Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize Jump Router Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize DSToken Compliance Diff Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize Whitelist ACL Support Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize Full Investor Locks Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize Solana Bridge Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| SecuritizeBridgeV2 Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize VaultRegistrarV2 Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize Solana SPL ACL Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Solana On/Off Ramp Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | 1 critical finding, fixed | Open · GitHub |
| Securitize EVM Whitelister Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Bridge Wormhole Executor Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize Public Stock On/Off Ramp Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Solana DSToken Whitelist Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Global Registry Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Solana SPL Token Whitelist Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | No open critical findings | Open · GitHub |
| Securitize DSToken Rebasing Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded. See the report | 1 critical finding, fixed | Open · GitHub |
Findings516
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 6 |
| High | 0 | 1 | 6 |
| Medium | 0 | 14 | 45 |
| Low | 5 | 131 | 308 |
HighEVM-to-Solana Transfers Can Permanently Burn Tokens by Producing a VAA That Solana Cannot DecodeSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportMediumPlatform-wallet routing bypasses the active non-US-to-US flowback restrictionSecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportMediumRegistryService mutation entry points omit EXCHANGE creator-match gate, enabling cross-tenant investor hijackingSecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportMediumCross-Chain Decimal Mismatch Causes Silent Value Corruption on MintSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportMediumInbound Transfers Mint Against Stale Destination Identity State Bypassing Jurisdiction-Specific Lock PeriodsSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportMediumSource-Chain Transfer-Hook Policies Are Bypassed by the Bridge Burn/Remint PathSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportMediumUnbounded TrackerAccount.issuances Growth Enables Relayer Rent Griefing and Eventual Bridge DoSSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportMediumIn-transit same-wallet VAA overwrites compliance attribute changes made on destination chain via unconditional Registry::updateInvestor in SecuritizeBridge::executeVAAv1SecuritizeBridgeV2 Audit Report · Cyfrin · 30 Mar 2026Acknowledged
The report gives no description here.
Open the reportMediumComplianceServiceRegulated applies double locking to investor transferable tokens leading to DoS of transfersSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportMediumeuRetailInvestorsCount is susceptible to underflow when transferring tokens between retail and qualified investors of the same country on the EU regionSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
MediumHistorical token issuances become subject to new lock-up requirements when users change residencySecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportMediumToken value locks done as part of issuance restrict subsequently transferred unlocked tokens after negative rebasingSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportMediumInvestors using smart contract wallets may have their destination chain tokens issued to an address they don’t controlAcknowledged
The report gives no description here.
MediumLack of a feature to allow investors to increase their nounceAcknowledged
The report gives no description here.
MediumMissing Slippage Check on liquidation_amount in Redemption- Enabled VaultsAcknowledged
The report gives no description here.
LowAn investor can pre-attach a predictable DS vault and block its Registrar registrationSecuritize SVM VaultRegistrar SPL ACL Audit · Cyfrin · 17 Sep 2026Acknowledged
The report gives no description here.
Open the reportLowComplianceService::validateSeize screens the seize destination only for special-wallet status, so a globally denylisted special wallet can still receive seized tokensSecuritize EVM GlobalDenyList Audit Report · Cyfrin · 11 Sep 2026Acknowledged
The report gives no description here.
Open the reportLowGlobalDenyListManager::changeAdmin zero-admin guard is bypassed by inherited AccessControlUpgradeable::revokeRole, renounceRole, permanently bricking admin-gated functionsSecuritize EVM GlobalDenyList Audit Report · Cyfrin · 11 Sep 2026Acknowledged
The report gives no description here.
Open the reportLowSanctioned addresses can be registered as investor or special wallets in breach of OFAC FAQ42Securitize EVM GlobalDenyList Audit Report · Cyfrin · 11 Sep 2026Acknowledged
The report gives no description here.
Open the reportLowDSToken::setMintCap, setOverCapGracePeriod accept unbounded inputs, so a mistaken governance proposal causes an issuance outage lasting at least one timelock delaySecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowTrustService::removeRole on an address with no role emits DSTrust- ServiceRoleAddedSecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Acknowledged
The report gives no description here.
Open the reportLowverify-governance compares service slots without attesting the deployed implementation, so it reports no drift in a state where Compliance- ConfigurationService rule setters remain transfer-agent gateSecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Acknowledged
The report gives no description here.
Open the reportLowdeploy-full.ts blindly retries one-shot deployment operationsSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Acknowledged
The report gives no description here.
Open the reportLowTip20TrustService::_project can revoke unmanaged native grantsSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Acknowledged
The report gives no description here.
Open the reportLowDe-whitelisting closes InvestorRegistry but does not re-freeze the owner’s token accountsSecuritize Bridge ACL Ext Audit Report · Cyfrin · 30 Jul 2026Acknowledged
The report gives no description here.
Open the reportLowMissing upfront validation during initializationSecuritize Bridge ACL Ext Audit Report · Cyfrin · 30 Jul 2026Acknowledged
The report gives no description here.
Open the reportLowWhitelist pause does not stop investor registry create/delete pathsSecuritize Bridge ACL Ext Audit Report · Cyfrin · 30 Jul 2026Acknowledged
The report gives no description here.
Open the reportLowRedundant SLOAD of dsToken in Securitize- Bridge::bridgeDSTokensToAddressSecuritize ZKsync Exit Bridge Audit Report · Cyfrin · 10 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowRedundant SLOAD of USDC in USDCBridgeV2::_transferUSDCSecuritize ZKsync Exit Bridge Audit Report · Cyfrin · 10 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowSecuritizeBridge::executeVAAv1 never checks vm.consistencyLevel so non-finalized VAAs can be consumed, enabling reorg-based supply inflationSecuritize ZKsync Exit Bridge Audit Report · Cyfrin · 10 Jun 2026Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowSecuritizeBridge::executeVAAv1 VAA payload omits destination-contract binding, enabling cross-instance double-mint across co-deployed bridge instances on one chainSecuritize ZKsync Exit Bridge Audit Report · Cyfrin · 10 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowUse assembly call for ETH transfers that discard return dataSecuritize ZKsync Exit Bridge Audit Report · Cyfrin · 10 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowCombined internal and external fees are not cappedSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowExecuteSwap::swap_asset_for_liquidity charges the sell-path fee on JUMP output instead of the QUODD-referenced inputSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowJumpRouterState collar and min-amount parameters have no bounds at init or in their settersSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowProtocol fee is charged on the gross amount instead of the post-external-fee remainderSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowRecomputed power-of-ten divisor in repeated per-swap price denormalizationSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowRouter admin can repoint an existing router to an unrelated Jump poolSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowSwap price events are denormalized using asset decimals instead of liquidity decimalsSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowUse a two-step admin transfer flow to reduce the risk of irreversible governance mistakesSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowComplianceServicePermissionless::preIssuanceCheck omits the pause check, allowing issuance while the token is paused contrary to FR-4Securitize DSToken Compliance Diff Audit Report · Cyfrin · 4 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowHardcoded MINT_CONFIG_DISCRIMINATOR = 1 duplicates upstream TACL state with no compile-time tie-backSecuritize Whitelist ACL Support Audit Report · Cyfrin · 2 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowSPL sRFC-37 access-control thaw forwards caller-selected CPI accounts without tying them to the validated authority pathSecuritize Whitelist ACL Support Audit Report · Cyfrin · 2 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowspl_token_whitelist::change_admin is single-step and accepts any Pubkey including the default zero keySecuritize Whitelist ACL Support Audit Report · Cyfrin · 2 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowWhitelisted event does not record which freeze-authority path was usedSecuritize Whitelist ACL Support Audit Report · Cyfrin · 2 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowComplianceServiceLibrary::completeTransferCheck EU retail cap lacks the != 0 guardSecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportLowComplianceServiceLibrary::completeTransferCheck reallocation short-circuit precedes the FORBIDDEN-destination checkSecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportLowComplianceServiceLibrary::getUSInvestorsLimit floor-zero leak and preIssuanceCheck raw-cap read fragment US-investor cap enforcementSecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportLowComplianceServiceLibrary::isMaximumHoldingsPerInvestorOk uses exclusive >=; sibling minimums use inclusive <Securitize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportLowComplianceServiceRegulated::getComplianceTransferableTokens lockup is current-country-derived, shifts on setCountrySecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowComplianceServiceRegulated::recordBurn and recordSeize skip lockup cleanup; stale records over-lock later inboundSecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportLowPlatform-wallet routing bypasses the NOT_ENOUGH_INVESTORS minimum-total-population floor on full-exit transfersSecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportLowPlatform-wallet routing bypasses three sender-side held-token min-balance checks in completeTransferCheckSecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportLowRegistryService::removeInvestor does not clear downstream state; recycled investor IDs inherit stale lockupsSecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportLowRegistryService::setAttribute ACCREDITED/QUALIFIED _expiry field stored but not read by the predicatesSecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportLowRegistryService::setAttribute skips compliance counter reconciliation on ACCREDITED/QUALIFIED flipsSecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportLowBridge flows do not implement on-chain rate limiting or cumulative volume capsSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportLowbridge_ds_tokens lamport pre-check excludes additional rent costsSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportLowinitialize does not pin usdc_mint to the canonical Solana USDC mintSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportLowPause blocks inbound VAA execution, stranding in-flight cross-chain transfersSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowUnnecessary Heap Clones of posted.payload and WormholeAddresses in Instruction HandlersSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportLowupdate_wormhole_accounts is for recovery, or for migration after a bridge upgrade, not for routine reconfigurationSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportLowUSDCBridgeSend does not expose a direct CCTP correlation identifierSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportLowSecuritizeBridge::_bridgeDSTokensInternal calls publishMessage before fee sufficiency check, wasting gas on revertSecuritizeBridgeV2 Audit Report · Cyfrin · 30 Mar 2026Acknowledged
The report gives no description here.
Open the reportLowchange_admin is single-step and permits irreversible admin loss through bad inputSecuritize Solana SPL ACL Audit Report · Cyfrin · 17 Mar 2026Acknowledged
The report gives no description here.
Open the reportLowCountries restriction defaults to empty on initialize, allowing all jurisdictions to use the protocolSolana On/Off Ramp Audit Report · Cyfrin · 19 Feb 2026Acknowledged
The report gives no description here.
Open the reportLowInsufficient checks on liquidity amount wastes compute unnecessarySolana On/Off Ramp Audit Report · Cyfrin · 19 Feb 2026Acknowledged
The report gives no description here.
Open the reportLowInvestor’s dsTokens May Become Locked After His Country Is BannedSolana On/Off Ramp Audit Report · Cyfrin · 19 Feb 2026Acknowledged
The report gives no description here.
Open the reportLowInvestors can grief OperatorsSolana On/Off Ramp Audit Report · Cyfrin · 19 Feb 2026Acknowledged
The report gives no description here.
Open the reportLowOperator Swap Signatures Are Replayable and Not Bound to a Specific On-Ramp or MintsSolana On/Off Ramp Audit Report · Cyfrin · 19 Feb 2026Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowWhitelister::whitelist duplicates checks already performed in RegistryService::addWalletSecuritize EVM Whitelister Audit Report · Cyfrin · 11 Feb 2026Acknowledged
The report gives no description here.
Open the reportLowAddition and removal functions can be combined into one functionBridge Wormhole Executor Audit Report · Cyfrin · 10 Feb 2026Acknowledged
The report gives no description here.
Open the reportLowGuardian sets can expire when SecuritizeBridge is pausedBridge Wormhole Executor Audit Report · Cyfrin · 10 Feb 2026Acknowledged
The report gives no description here.
Open the reportLowUnnecessary sequence lookup and request construction in Securitize- Bridge::_quoteBridgeBridge Wormhole Executor Audit Report · Cyfrin · 10 Feb 2026Acknowledged
The report gives no description here.
Open the reportLowBlock number deadline is chain dependent and unreliable across L2sSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowCache computation where it is performed multiple timesSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowCache decimals of underlying asset at initialization in SecuritizeAmm- NavProviderSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowCache required storage slots in top-level functions then pass cached values to child functionsSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowConsider enforcing minimum redemption amounts in PublicStockOffRamp, SecuritizeOffRamp::redeemSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowFee calculation occurs twiceSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowIncorrect rounding of rate in favor of users when they buy DS TokensSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowMbpsFeeManager::setFeePercentageMBPS allows setting fee greater than maxSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowNot way to change the recipient in the liquidity provider in the offramp logicSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowRefactor identical code from SecuritizeAmmNavProvider::_pricingFromCurveBuy, _pricingFromCurveSell into internal functionSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowRefactor PublicStockOnRamp::initializedNavProvider, BaseOffRamp::nonZeroLiquidityProvider into internal functions to prevent identical storage readsSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowSecuritizeOnRamp doesn’t provide a mechanism for investors to invalidate their noncesSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowSingle step redemption and two step redemption not equivalent logicSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowUnused nonce Field in ExecutePreApprovedTransaction structSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowUse of modifier nonZeroNavRate in SecuritizeOnRamp and SecuritizeOffRamp results in duplicate external call with identical resultSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowTransaction size limit could be exceeded with non-empty hashesSolana DSToken Whitelist Audit Report · Cyfrin · 7 Nov 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowGlobalRegistryService::executePreApprovedTransaction is incompatible with smart wallet operatorsGlobal Registry Audit Report · Cyfrin · 6 Nov 2025Acknowledged
The report gives no description here.
Open the reportLowIn StandardToken::updateNameAndSymbol cache existing name and symbol then pass them to child functionsGlobal Registry Audit Report · Cyfrin · 6 Nov 2025Acknowledged
The report gives no description here.
Open the reportLowInherited AccessControlUpgradeable functions bypass some validation checksGlobal Registry Audit Report · Cyfrin · 6 Nov 2025Acknowledged
The report gives no description here.
Open the reportLowInline small private functions only called onceGlobal Registry Audit Report · Cyfrin · 6 Nov 2025Acknowledged
The report gives no description here.
Open the reportLowPermanent delegate extension creates irreversible token control riskSolana SPL Token Whitelist Audit Report · Cyfrin · 31 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowAttribute changes via setAttribute or updateInvestor do NOT trigger compliance count updates.Securitize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowCache compliance service and compliance configuration service for much cleaner code in ComplianceServiceRegulated::completeTransferCheckSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowCache computation results instead of repeatedly performing the same computationSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowCache result of identical external calls when the result can’t changeSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowCache storage to prevent identical storage readsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowComplianceConfigurationService::getWorldWideForceFullTransfer is not applied to US investorsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowComplianceServiceRegulated::getServices should use constants from ComplianceServiceLibrary when setting array indexesSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowFeature flags are not being used in the TokenLibrarySecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowIn Solidity don’t initialize to default valuesSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowInvestorLockManager::createLockForInvestor, removeLockRecord- ForInvestor should revert for invalid investor idSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowMore efficient way of comparing two strings for equality in CommonUtils::isEqualStringSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowNo way for users to invalidate nonce used to signSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowNot maximum amount of issuances enforceSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowNot mechanism to automatically cleanup locks that are already unlock-able on LockManagersSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowPerform local variable checks first prior to external calls in composite if statement conditionsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowPossible to escape burning of DSTokens by removing the wallet from the current investor and adding it as the wallet of another investorSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowProtocol will leak value to users due to rounding in RebasingLibrarySecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowRefactor duplicated checks into modifiersSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowRemove deprecated collision hash and proof hash from function callsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowSeized tokens will be stuck on the receiver of the seized funds because it is not an investor and never receives investorsBalanceSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowSince attribute expiration is deprecated, remove as input parameters, don’t write it to storage and put comment explaining thisSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowStale Issuance Records After Burn and Seize OperationsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowUse named constants instead of hard-coded literals for important valuesSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowUse named return variables where this optimizes away a local variable definitionSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowUsing block.number instead of block.timestamp as an expiration check to execute signatureSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBulk issuance enforces a single issuanceTime for all recipients, preventing flexible schedulingAcknowledged
The report gives no description here.
LowCache storage to prevent identical storage readsAcknowledged
The report gives no description here.
LowEmission of wrong value for some eventsAcknowledged
The report gives no description here.
LowGas inefficient approval pattern in liquidation function leads to unnecessary gas consumptionAcknowledged
The report gives no description here.
LowGeneral notes on the designAcknowledged
The report gives no description here.
LowInconsistent usage of whenNotPaused modifier for bridging fulfillment in SecuritizeBridge and USDCBridgeV2Acknowledged
The report gives no description here.
LowIneffective lock time condition in getComplianceTransferableTokens leads to misleading logicAcknowledged
The report gives no description here.
LowLack of wallet validation when attaching may lead in Denial Of ServiceAcknowledged
The report gives no description here.
LowMisleading event emission in USDCBridgeV2::addBridgeCaller, removeBridgeCaller when role was not granted or revokedAcknowledged
The report gives no description here.
LowMissing Two Step Ownership And Authority Transfer ValidationAcknowledged
The report gives no description here.
Show 10 more
LowMissing Two-Step Ownership Transfer Protection in ServiceConsumerAcknowledged
The report gives no description here.
LowNew lock values check missingAcknowledged
The report gives no description here.
LowPass _refundChain as input to USDCBridgeV2::_buildCCTPKey saves 1 storage read and external callAcknowledged
The report gives no description here.
LowPending/re-executable messages sourced from old bridge addresses will not be executable if bridge address is updatedAcknowledged
The report gives no description here.
LowPotential Out-of-Gas Risk in getTokenBalances for Large Input ArraysAcknowledged
The report gives no description here.
LowPrefer Ownable2StepUpgradeable instead of OwnableUpgradeable in BaseContractAcknowledged
The report gives no description here.
LowRemove unused return from USDCBridgeV2:_sendUSDCWithPayloadTo- EvmAcknowledged
The report gives no description here.
LowRename SecuritizeBridge::whChainId to whRefundChainIdAcknowledged
The report gives no description here.
LowShare tokens can be transferredAcknowledged
The report gives no description here.
LowSingle-step admin transfer creates risk of permanent loss of administrative controlAcknowledged
The report gives no description here.
Show 6 more
LowUninitialized country for valid investor wallets allows bypassing US compliance lockup periodAcknowledged
The report gives no description here.
LowUnnecessary dynamic array allocation in issueTokensCustom wastes gasAcknowledged
The report gives no description here.
LowUpgradeable contracts which are inherited from should use ERC7201 namespaced storage layouts or storage gaps to prevent storage collisionAcknowledged
The report gives no description here.
LowUSDCBridgeV2 can’t bridge to non-EVM chains even though Wormhole and Circle CCTP support thisAcknowledged
The report gives no description here.
LowUse named return values where this can eliminate local variablesAcknowledged
The report gives no description here.
LowUse ReentrancyGuardTransientUpgradeable for faster nonReentrant modifiersAcknowledged
The report gives no description here.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="securitize"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us