Securitize security record
As of 3 Nov 2026, Securitize has 37 audit reports by 2 security firms on Trustblock; the latest is by Cyfrin, dated 17 Sep 2026. Those reports list no open critical findings.
Critical findings
No open critical findings
Across the 37 reports, 6 critical findings were reported. Each is marked fixed by the firm that reported it. See the findings
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits37
Newest first
37 audit reports, 32 in Cyfrin’s series
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Securitize SVM VaultRegistrar SPL ACL Audit | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize Solana Whitelister Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize EVM GlobalDenyList Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize DSToken Timelocks Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize Tempo TIP-20 Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize EVM Async Vault Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize Bridge ACL Ext Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize MatchHandler Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize ZKsync Exit Bridge Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize Jump Router Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize DSToken Compliance Diff Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize Whitelist ACL Support Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize Full Investor Locks Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize Solana Bridge Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| SecuritizeBridgeV2 Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize VaultRegistrarV2 Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize Solana SPL ACL Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Solana On/Off Ramp Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Securitize EVM Whitelister Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Bridge Wormhole Executor Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize Public Stock On/Off Ramp Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Solana DSToken Whitelist Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Global Registry Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Solana SPL Token Whitelist Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Securitize DSToken Rebasing Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
Findings222
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 6 |
| High | 0 | 1 | 6 |
| Medium | 0 | 14 | 45 |
| Low | 2 | 38 | 110 |
Marked Gas or Informational by the firms. Not counted as findings.
InformationalServiceConsumer::setDSService accepts an address with no code, halting all transfers and issuance on the wired tokenSecuritize EVM GlobalDenyList Audit Report · Cyfrin · 11 Sep 2026Open
The report gives no description here.
Open the reportInformationalGovernance script gaps: the pre-handover checklist asserts stored values rather than installed behaviour or reachable authoritySecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Open
The report gives no description here.
Open the reportInformationalMatchHandler has several minor code-quality and documentation mismatchesSecuritize MatchHandler Audit Report · Cyfrin · 11 Jun 2026Open
The report gives no description here.
Open the reportInformationalComplianceService::validateSeize screens the seize destination only for special-wallet status, so a globally denylisted special wallet can still receive seized tokensSecuritize EVM GlobalDenyList Audit Report · Cyfrin · 11 Sep 2026Acknowledged
The report gives no description here.
Open the reportInformationalDSToken::setMintCap, setOverCapGracePeriod accept unbounded inputs, so a mistaken governance proposal causes an issuance outage lasting at least one timelock delaySecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Acknowledged
The report gives no description here.
Open the reportInformationalTrustService::removeRole on an address with no role emits DSTrust- ServiceRoleAddedSecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Acknowledged
The report gives no description here.
Open the reportInformationalverify-governance compares service slots without attesting the deployed implementation, so it reports no drift in a state where Compliance- ConfigurationService rule setters remain transfer-agent gateSecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Acknowledged
The report gives no description here.
Open the reportInformationaldeploy-full.ts blindly retries one-shot deployment operationsSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Acknowledged
The report gives no description here.
Open the reportInformationalTip20TrustService::_project can revoke unmanaged native grantsSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Acknowledged
The report gives no description here.
Open the reportInformationalMissing upfront validation during initializationSecuritize Bridge ACL Ext Audit Report · Cyfrin · 30 Jul 2026Acknowledged
The report gives no description here.
Open the reportShow 10 more
InformationalWhitelist pause does not stop investor registry create/delete pathsSecuritize Bridge ACL Ext Audit Report · Cyfrin · 30 Jul 2026Acknowledged
The report gives no description here.
Open the reportGasRedundant SLOAD of dsToken in Securitize- Bridge::bridgeDSTokensToAddressSecuritize ZKsync Exit Bridge Audit Report · Cyfrin · 10 Jun 2026Acknowledged
The report gives no description here.
Open the reportGasRedundant SLOAD of USDC in USDCBridgeV2::_transferUSDCSecuritize ZKsync Exit Bridge Audit Report · Cyfrin · 10 Jun 2026Acknowledged
The report gives no description here.
Open the reportGasUse assembly call for ETH transfers that discard return dataSecuritize ZKsync Exit Bridge Audit Report · Cyfrin · 10 Jun 2026Acknowledged
The report gives no description here.
Open the reportInformationalCombined internal and external fees are not cappedSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Acknowledged
The report gives no description here.
Open the reportInformationalJumpRouterState collar and min-amount parameters have no bounds at init or in their settersSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Acknowledged
The report gives no description here.
Open the reportGasRecomputed power-of-ten divisor in repeated per-swap price denormalizationSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Acknowledged
The report gives no description here.
Open the reportInformationalRouter admin can repoint an existing router to an unrelated Jump poolSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Acknowledged
The report gives no description here.
Open the reportInformationalUse a two-step admin transfer flow to reduce the risk of irreversible governance mistakesSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Acknowledged
The report gives no description here.
Open the reportInformationalHardcoded MINT_CONFIG_DISCRIMINATOR = 1 duplicates upstream TACL state with no compile-time tie-backSecuritize Whitelist ACL Support Audit Report · Cyfrin · 2 Jun 2026Acknowledged
The report gives no description here.
Open the reportShow 10 more
InformationalSPL sRFC-37 access-control thaw forwards caller-selected CPI accounts without tying them to the validated authority pathSecuritize Whitelist ACL Support Audit Report · Cyfrin · 2 Jun 2026Acknowledged
The report gives no description here.
Open the reportInformationalWhitelisted event does not record which freeze-authority path was usedSecuritize Whitelist ACL Support Audit Report · Cyfrin · 2 Jun 2026Acknowledged
The report gives no description here.
Open the reportInformationalComplianceServiceLibrary::completeTransferCheck EU retail cap lacks the != 0 guardSecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportInformationalComplianceServiceLibrary::completeTransferCheck reallocation short-circuit precedes the FORBIDDEN-destination checkSecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportInformationalComplianceServiceLibrary::isMaximumHoldingsPerInvestorOk uses exclusive >=; sibling minimums use inclusive <Securitize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportInformationalRegistryService::setAttribute ACCREDITED/QUALIFIED _expiry field stored but not read by the predicatesSecuritize Full Investor Locks Audit Report · Cyfrin · 29 May 2026Acknowledged
The report gives no description here.
Open the reportInformationalbridge_ds_tokens lamport pre-check excludes additional rent costsSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportInformationalinitialize does not pin usdc_mint to the canonical Solana USDC mintSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportGasUnnecessary Heap Clones of posted.payload and WormholeAddresses in Instruction HandlersSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportInformationalupdate_wormhole_accounts is for recovery, or for migration after a bridge upgrade, not for routine reconfigurationSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportShow 10 more
InformationalUSDCBridgeSend does not expose a direct CCTP correlation identifierSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Acknowledged
The report gives no description here.
Open the reportGasSecuritizeBridge::_bridgeDSTokensInternal calls publishMessage before fee sufficiency check, wasting gas on revertSecuritizeBridgeV2 Audit Report · Cyfrin · 30 Mar 2026Acknowledged
The report gives no description here.
Open the reportInformationalchange_admin is single-step and permits irreversible admin loss through bad inputSecuritize Solana SPL ACL Audit Report · Cyfrin · 17 Mar 2026Acknowledged
The report gives no description here.
Open the reportInformationalInsufficient checks on liquidity amount wastes compute unnecessarySolana On/Off Ramp Audit Report · Cyfrin · 19 Feb 2026Acknowledged
The report gives no description here.
Open the reportInformationalInvestor’s dsTokens May Become Locked After His Country Is BannedSolana On/Off Ramp Audit Report · Cyfrin · 19 Feb 2026Acknowledged
The report gives no description here.
Open the reportGasWhitelister::whitelist duplicates checks already performed in RegistryService::addWalletSecuritize EVM Whitelister Audit Report · Cyfrin · 11 Feb 2026Acknowledged
The report gives no description here.
Open the reportGasAddition and removal functions can be combined into one functionBridge Wormhole Executor Audit Report · Cyfrin · 10 Feb 2026Acknowledged
The report gives no description here.
Open the reportGasUnnecessary sequence lookup and request construction in Securitize- Bridge::_quoteBridgeBridge Wormhole Executor Audit Report · Cyfrin · 10 Feb 2026Acknowledged
The report gives no description here.
Open the reportGasCache computation where it is performed multiple timesSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportGasCache decimals of underlying asset at initialization in SecuritizeAmm- NavProviderSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
GasCache required storage slots in top-level functions then pass cached values to child functionsSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportInformationalConsider enforcing minimum redemption amounts in PublicStockOffRamp, SecuritizeOffRamp::redeemSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportGasFee calculation occurs twiceSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportInformationalMbpsFeeManager::setFeePercentageMBPS allows setting fee greater than maxSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportInformationalNot way to change the recipient in the liquidity provider in the offramp logicSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportInformationalRefactor identical code from SecuritizeAmmNavProvider::_pricingFromCurveBuy, _pricingFromCurveSell into internal functionSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportGasRefactor PublicStockOnRamp::initializedNavProvider, BaseOffRamp::nonZeroLiquidityProvider into internal functions to prevent identical storage readsSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportInformationalSingle step redemption and two step redemption not equivalent logicSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportInformationalUnused nonce Field in ExecutePreApprovedTransaction structSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportGasUse of modifier nonZeroNavRate in SecuritizeOnRamp and SecuritizeOffRamp results in duplicate external call with identical resultSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
InformationalTransaction size limit could be exceeded with non-empty hashesSolana DSToken Whitelist Audit Report · Cyfrin · 7 Nov 2025Acknowledged
The report gives no description here.
Open the reportInformationalGlobalRegistryService::executePreApprovedTransaction is incompatible with smart wallet operatorsGlobal Registry Audit Report · Cyfrin · 6 Nov 2025Acknowledged
The report gives no description here.
Open the reportGasIn StandardToken::updateNameAndSymbol cache existing name and symbol then pass them to child functionsGlobal Registry Audit Report · Cyfrin · 6 Nov 2025Acknowledged
The report gives no description here.
Open the reportInformationalInherited AccessControlUpgradeable functions bypass some validation checksGlobal Registry Audit Report · Cyfrin · 6 Nov 2025Acknowledged
The report gives no description here.
Open the reportGasInline small private functions only called onceGlobal Registry Audit Report · Cyfrin · 6 Nov 2025Acknowledged
The report gives no description here.
Open the reportInformationalPermanent delegate extension creates irreversible token control riskSolana SPL Token Whitelist Audit Report · Cyfrin · 31 Oct 2025Acknowledged
The report gives no description here.
Open the reportInformationalCache compliance service and compliance configuration service for much cleaner code in ComplianceServiceRegulated::completeTransferCheckSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportGasCache computation results instead of repeatedly performing the same computationSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportGasCache result of identical external calls when the result can’t changeSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportGasCache storage to prevent identical storage readsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
InformationalComplianceConfigurationService::getWorldWideForceFullTransfer is not applied to US investorsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportInformationalComplianceServiceRegulated::getServices should use constants from ComplianceServiceLibrary when setting array indexesSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportInformationalFeature flags are not being used in the TokenLibrarySecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportGasIn Solidity don’t initialize to default valuesSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportInformationalInvestorLockManager::createLockForInvestor, removeLockRecord- ForInvestor should revert for invalid investor idSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportGasMore efficient way of comparing two strings for equality in CommonUtils::isEqualStringSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportInformationalNot mechanism to automatically cleanup locks that are already unlock-able on LockManagersSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportGasPerform local variable checks first prior to external calls in composite if statement conditionsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportInformationalPossible to escape burning of DSTokens by removing the wallet from the current investor and adding it as the wallet of another investorSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportInformationalRefactor duplicated checks into modifiersSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
GasRemove deprecated collision hash and proof hash from function callsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportGasSince attribute expiration is deprecated, remove as input parameters, don’t write it to storage and put comment explaining thisSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportInformationalUse named constants instead of hard-coded literals for important valuesSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportGasUse named return variables where this optimizes away a local variable definitionSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportInformationalUsing block.number instead of block.timestamp as an expiration check to execute signatureSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Acknowledged
The report gives no description here.
Open the reportGasCache storage to prevent identical storage readsAcknowledged
The report gives no description here.
InformationalEmission of wrong value for some eventsAcknowledged
The report gives no description here.
GasGas inefficient approval pattern in liquidation function leads to unnecessary gas consumptionAcknowledged
The report gives no description here.
InformationalGeneral notes on the designAcknowledged
The report gives no description here.
InformationalLack of wallet validation when attaching may lead in Denial Of ServiceAcknowledged
The report gives no description here.
Show 10 more
InformationalMisleading event emission in USDCBridgeV2::addBridgeCaller, removeBridgeCaller when role was not granted or revokedAcknowledged
The report gives no description here.
InformationalMissing Two Step Ownership And Authority Transfer ValidationAcknowledged
The report gives no description here.
InformationalMissing Two-Step Ownership Transfer Protection in ServiceConsumerAcknowledged
The report gives no description here.
InformationalNew lock values check missingAcknowledged
The report gives no description here.
GasPass _refundChain as input to USDCBridgeV2::_buildCCTPKey saves 1 storage read and external callAcknowledged
The report gives no description here.
InformationalPending/re-executable messages sourced from old bridge addresses will not be executable if bridge address is updatedAcknowledged
The report gives no description here.
InformationalPotential Out-of-Gas Risk in getTokenBalances for Large Input ArraysAcknowledged
The report gives no description here.
InformationalPrefer Ownable2StepUpgradeable instead of OwnableUpgradeable in BaseContractAcknowledged
The report gives no description here.
GasRemove unused return from USDCBridgeV2:_sendUSDCWithPayloadTo- EvmAcknowledged
The report gives no description here.
InformationalRename SecuritizeBridge::whChainId to whRefundChainIdAcknowledged
The report gives no description here.
Show 10 more
InformationalSingle-step admin transfer creates risk of permanent loss of administrative controlAcknowledged
The report gives no description here.
InformationalUninitialized country for valid investor wallets allows bypassing US compliance lockup periodAcknowledged
The report gives no description here.
InformationalUnnecessary dynamic array allocation in issueTokensCustom wastes gasAcknowledged
The report gives no description here.
InformationalUSDCBridgeV2 can’t bridge to non-EVM chains even though Wormhole and Circle CCTP support thisAcknowledged
The report gives no description here.
GasUse named return values where this can eliminate local variablesAcknowledged
The report gives no description here.
GasUse ReentrancyGuardTransientUpgradeable for faster nonReentrant modifiersAcknowledged
The report gives no description here.
GasCache repeated access_control_authority_pda and mint_config_pda derivations to cut redundant hashing in the SPL register and thaw flowSecuritize SVM VaultRegistrar SPL ACL Audit · Cyfrin · 17 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalDead Error Variants and Documentation Inconsistency for Signature RequirementsSecuritize Solana Whitelister Audit Report · Cyfrin · 17 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalExplicitly reject Pubkey::default() for vault_wallet or the investor_walletSecuritize Solana Whitelister Audit Report · Cyfrin · 17 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalInsufficient validation on vaultsSecuritize Solana Whitelister Audit Report · Cyfrin · 17 Sep 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalOperators can thaw a frozen vault ATA through register_vault_spl under extreme casesSecuritize SVM VaultRegistrar SPL ACL Audit · Cyfrin · 17 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalPermissionless Initialize and Counter Saturation Edge CaseSecuritize Solana Whitelister Audit Report · Cyfrin · 17 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalPermissionless initialize derives the registrar state and authority PDAs from a shared monotonic counter, letting any caller front-run and invalidate pre-signed setup transactionsSecuritize SVM VaultRegistrar SPL ACL Audit · Cyfrin · 17 Sep 2026Fixed
The report gives no description here.
Open the reportGasRedundant Zero-Address Check in revoke_operatorSecuritize Solana Whitelister Audit Report · Cyfrin · 17 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalset_require_investor_signature allows setting to current value, emitting misleading eventSecuritize Solana Whitelister Audit Report · Cyfrin · 17 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalSPL investor token account is not explicitly restricted to Token-2022Securitize SVM VaultRegistrar SPL ACL Audit · Cyfrin · 17 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalthaw_vault_token_account_spl unconditionally CPIs ACL thaw_account and reverts on an already-thawed vault token account, unlike the guarded register_vault_spl pathSecuritize SVM VaultRegistrar SPL ACL Audit · Cyfrin · 17 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalVaultRegistered event omits investor signer when signature is requiredSecuritize Solana Whitelister Audit Report · Cyfrin · 17 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalVaultRegisteredDs can report a signer unrelated to the attached identitySecuritize SVM VaultRegistrar SPL ACL Audit · Cyfrin · 17 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalVaultRegistrarInitialized omits the initial require_investor_signature valueSecuritize SVM VaultRegistrar SPL ACL Audit · Cyfrin · 17 Sep 2026Fixed
The report gives no description here.
Open the reportShow 10 more
GasCache identical storage reads in ComplianceServicePermissionless::_isGloballyDenylisted, _isLocallyBlacklistedSecuritize EVM GlobalDenyList Audit Report · Cyfrin · 11 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalDenylist mutators always return true, discarding the EnumerableSet resultSecuritize EVM GlobalDenyList Audit Report · Cyfrin · 11 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalDeploy task implicit GlobalDenyListManager::initialize resolution can silently deploy an uninitialized proxySecuritize EVM GlobalDenyList Audit Report · Cyfrin · 11 Sep 2026Fixed
The report gives no description here.
Open the reportInformationaldeploy-all does not await GlobalDenyListManager::addOperator, changeAdmin receipts and reports success on unconfirmed transactionsSecuritize EVM GlobalDenyList Audit Report · Cyfrin · 11 Sep 2026Fixed
The report gives no description here.
Open the reportInformationaldeploy-all treats a zero –global-denylist-manager-address as wired, logging success while leaving global denylist enforcement offSecuritize EVM GlobalDenyList Audit Report · Cyfrin · 11 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalGlobalDenyListManager::revokeOperator is bypassable via inherited AccessControlUpgradeable::revokeRole, renounceRole, which emit no OperatorRevokedSecuritize EVM GlobalDenyList Audit Report · Cyfrin · 11 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalA single TimelockController::scheduleBatch containing updateDelay set to zero converts a delayed controller into an instant one for the cost of one delaySecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalBulkOperator holds ROLE_ISSUER but is registered under no service id, so handover and verification cannot see it and its owner retains instant upgrade authoritySecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalDSToken::scheduleOverCapIssuance includes block.timestamp in the operation id, so one salt can schedule the same mint repeatedly in different blocksSecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalGate DSToken::executeOverCapMint on the token pause to give the transfer agent an instant block on scheduled exceptional mintsSecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalIDSServiceConsumer::DEPRECATED_ISSUER_MULTICALL, DEPRE- CATED_TA_MULTICALL are both zero while the deployment utilities define them as 8194 and 8195, leaving two incompatible service-id registriesSecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalMinting-control documentation is stale on window reset and silent on exceptional-mint operations and the tumbling-window boundarySecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalsetup-governance handover omits deprecated service ids so pre-handover key retains OwnableUpgradeable::owner upgrade authority over live ROLE_ISSUER and ROLE_TRANSFER_AGENT proxies and can burn, seizeSecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalsetup-governance surrenders ROLE_MASTER before confirming every ownership transfer succeeded, so a silently skipped owner mismatch leaves a live ROLE_ISSUER proxy outside the timelock and is detectedSecuritize DSToken Timelocks Audit Report · Cyfrin · 7 Sep 2026Fixed
The report gives no description here.
Open the reportInformationaldeploy-full.ts can never execute mint stepSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Fixed
The report gives no description here.
Open the reportInformationaldeploy-full.ts does not verify the target Tempo networkSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Fixed
The report gives no description here.
Open the reportInformationaldeploy-full.ts permits overlapping operational role addressesSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Fixed
The report gives no description here.
Open the reportInformationaldeploy-full.ts suppresses investor onboarding failuresSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalITip20TrustService misdocuments MASTER native permissionsSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalTip20RegistryService events do not expose effective wallet authorizationSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalTip20RegistryService storage-gap comment has the wrong slot countSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalTip20RegistryService::addPlatformWallet has an unreachable duplicate checkSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalTip20RegistryService::initialize does not reject a zero adminSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalTip20RegistryService::isAuthorized documentation does not match policy stateSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalTip20RegistryService::registerInvestorWithWallets can retain stale proof metadataSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalTip20RegistryService::registerInvestorWithWallets, isAuthorized mishandle Tempo virtual addressesSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalTip20RegistryService::setServiceConsumer missing eventSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalTip20TrustService::_setRole emits abstract-role events after native callsSecuritize Tempo TIP-20 Audit Report · Cyfrin · 28 Aug 2026Fixed
The report gives no description here.
Open the reportInformationalEmpty investor_id can be persisted in InvestorRegistry and propagated through the SPL bridgeSecuritize Bridge ACL Ext Audit Report · Cyfrin · 30 Jul 2026Fixed
The report gives no description here.
Open the reportInformationalInconsistent investor_id length limits across layers (64 vs 256) and an undocumented 32-byte PDA-seed constraint on the DS pathSecuritize Bridge ACL Ext Audit Report · Cyfrin · 30 Jul 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalOutbound DS/SPL bridge handlers do not validate EVM recipient address formatSecuritize Bridge ACL Ext Audit Report · Cyfrin · 30 Jul 2026Fixed
The report gives no description here.
Open the reportGasRedundant heap clone of the up-to-1024-byte VAA payload on every inbound bridge transactionSecuritize Bridge ACL Ext Audit Report · Cyfrin · 30 Jul 2026Fixed
The report gives no description here.
Open the reportInformationalsecuritize_bridge inbound SPL resolver hardcodes the Token-2022 program for ATA derivation, breaking inbound delivery for a classic-SPL-Token mint configured as TokenConfig::SplSecuritize Bridge ACL Ext Audit Report · Cyfrin · 30 Jul 2026Fixed
The report gives no description here.
Open the reportInformationaltracker_account binding is not validated upfront in bridge_ds_tokensSecuritize Bridge ACL Ext Audit Report · Cyfrin · 30 Jul 2026Fixed
The report gives no description here.
Open the reportGasMatchHandler::addOperator, removeOperator call the public grant- Role, revokeRole instead of the internal _grantRole, _revokeRoleSecuritize MatchHandler Audit Report · Cyfrin · 11 Jun 2026Fixed
The report gives no description here.
Open the reportGasRedundant custodialWallet storage read on the matchOrder settlement pathSecuritize MatchHandler Audit Report · Cyfrin · 11 Jun 2026Fixed
The report gives no description here.
Open the reportInformationalSupplied MatchHandler deployment flow does not establish required registry authorizationSecuritize MatchHandler Audit Report · Cyfrin · 11 Jun 2026Fixed
The report gives no description here.
Open the reportInformationalRemove unused import BaseDSContract from SecuritizeBridge.solSecuritize ZKsync Exit Bridge Audit Report · Cyfrin · 10 Jun 2026Fixed
The report gives no description here.
Open the reportInformationalRemove ZKSyncSecuritizeBridge::withdrawETH and in bridgeDSTokens revert when msg.value > 0Securitize ZKsync Exit Bridge Audit Report · Cyfrin · 10 Jun 2026Fixed
The report gives no description here.
Open the reportInformationalcalculate_jump_price requires mint decimals <= 18 but initialize and update_jump_pool_config never validate the boundSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Fixed
The report gives no description here.
Open the reportShow 10 more
Informationalcalculate_jump_price returns a liquidity-over-asset ratio while three unit tests assert the inverseSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Fixed
The report gives no description here.
Open the reportInformationalFee collector default pubkey Is not rejected while InitializationSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Fixed
The report gives no description here.
Open the reportInformationalJumpRouterCounter uses init_if_needed with a fixed singleton seedSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Fixed
The report gives no description here.
Open the reportInformationalMbpsFeeManager doc comments mislabel milli-basis-points as basis pointsSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Fixed
The report gives no description here.
Open the reportInformationalRedemptionCompleted emits gross liquidity output rather than the user’s net received amountSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Fixed
The report gives no description here.
Open the reportInformationalSource filename mpbs_fee_manager.rs has transposed lettersSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Fixed
The report gives no description here.
Open the reportInformationalStandard execute_swap accepts an empty regulatory external_idSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Fixed
The report gives no description here.
Open the reportInformationalUpdateJumpPoolConfig::update_jump_pool_config repoints mints but does not reset min_asset_amount_in, min_liquidity_amount_inSecuritize Jump Router Audit Report · Cyfrin · 9 Jun 2026Fixed
The report gives no description here.
Open the reportInformationalgetWhitelistIxs is not checking the ownership of the tokenAccounts passed with tx ownerSecuritize Whitelist ACL Support Audit Report · Cyfrin · 2 Jun 2026Fixed
The report gives no description here.
Open the reportInformationalDead Code Where country_string_to_u8 and CctpDomainNotConfigured Are Not UsedSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalDS bridge initialize accepts zero-value parameters that update instructions rejectSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportInformationalExecutor quotes must use the same gas limit as on-chain executor_gas_limitSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportInformationalformat! used where .to_string() suffices for country conversionSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportInformationalGasLimitUpdate event in DS bridge uses u128 fields unnecessarilySecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportGasInstruction Handlers Use find_program_address Where Cheaper Derivation Is AvailableSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportInformationalMagic numbers in securitize_usdc_bridge::initialize for default config valuesSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportInformationalMissing events for initialize instructions in both programsSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportInformationalMissing zero-value validation for gas_limit parameter in both bridgesSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportInformationalNo ownership transfer mechanism for bridge config in either programSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportInformationalPauseStatusChanged is not mint-self-describing for off-chain consumersSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportShow 10 more
Gasposted.payload.clone() copies entire VAA payload unnecessarily in execute_vaa_v1Securitize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportInformationalread_current_sequence uses ANCHOR_DISCRIMINATOR_LEN for raw Wormhole u64 dataSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportGasRedundant immutable borrow in set_bridge_address and set_emitter_addressSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportGasResolver Re-derives PDAs Already Computed by Caller, Wasting ~4,500+ CU per ResolutionSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportInformationalResolverConfig PDA uses big-endian chain seed while other chain-seeded PDAs use little-endianSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportInformationalset_cctp_domain uses bump value of 0 as sentinel for new account detectionSecuritize Solana Bridge Audit Report · Cyfrin · 30 Apr 2026Fixed
The report gives no description here.
Open the reportInformationalInvestor Cannot Revoke Standing Permission for a Removed OperatorSecuritize VaultRegistrarV2 Audit Report · Cyfrin · 30 Mar 2026Fixed
The report gives no description here.
Open the reportInformationalVaultRegistrar::isRegistered reverts instead of returning false when vault belongs to a different investorSecuritize VaultRegistrarV2 Audit Report · Cyfrin · 30 Mar 2026Fixed
The report gives no description here.
Open the reportInformationalIncorrect Documentation Comment for create_config_handlerSecuritize Solana SPL ACL Audit Report · Cyfrin · 17 Mar 2026Fixed
The report gives no description here.
Open the reportInformationalnew_freeze_authority Omitted from DeleteConfig EventSecuritize Solana SPL ACL Audit Report · Cyfrin · 17 Mar 2026Fixed
The report gives no description here.
Open the reportShow 10 more
GasRedundant executable check for token ACL program after address validationSecuritize Solana SPL ACL Audit Report · Cyfrin · 17 Mar 2026Fixed
The report gives no description here.
Open the reportInformationalSeveral error variants are defined but currently unusedSecuritize Solana SPL ACL Audit Report · Cyfrin · 17 Mar 2026Fixed
The report gives no description here.
Open the reportInformationaltoken_account is missing a local mint == mint.key() constraint in authority flowsSecuritize Solana SPL ACL Audit Report · Cyfrin · 17 Mar 2026Fixed
The report gives no description here.
Open the reportInformationalUnnecessary mut constraint on mint in read-only ops delays genuine operations that require mint to be mutableSecuritize Solana SPL ACL Audit Report · Cyfrin · 17 Mar 2026Fixed
The report gives no description here.
Open the reportInformationalIncompatible NavProviders can be set, which could fail swaps temporarilySolana On/Off Ramp Audit Report · Cyfrin · 19 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalOff-Ramp update_fee_manager Does Not Validate liquidity_mintSolana On/Off Ramp Audit Report · Cyfrin · 19 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalOn-Ramp initialize Should Reject Zero Genesis HashSolana On/Off Ramp Audit Report · Cyfrin · 19 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalRedundant [instruction(asset_provider)] Attribute in On-Ramp UpdateAssetProviderSolana On/Off Ramp Audit Report · Cyfrin · 19 Feb 2026Fixed
The report gives no description here.
Open the reportGasBaseWhitelister::addOperator, removeOperator should use _grantRole and _revokeRole directly and only emit events when they return trueSecuritize EVM Whitelister Audit Report · Cyfrin · 11 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalImplement recommended changes to proposed vault whitelister standardSecuritize EVM Whitelister Audit Report · Cyfrin · 11 Feb 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalIncorrect pragma as support for defining operators on user-defined value types was added in Solidity 0.8.19Securitize EVM Whitelister Audit Report · Cyfrin · 11 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalPermissionFlags::and function will encode the permission for SWAP_AL- LOWED AND LIQUIDITY_ALLOWED as if the account would have NONE permissionsSecuritize EVM Whitelister Audit Report · Cyfrin · 11 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalPermissionFlags::hasFlag can’t be used to check for Permission- Flag::NONESecuritize EVM Whitelister Audit Report · Cyfrin · 11 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalPermissionFlags::hasFlag inconsistent validation for combined flagsSecuritize EVM Whitelister Audit Report · Cyfrin · 11 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalPermissionFlags::hasFlag incorrectly grants ALL_PERMISSIONS to PermissionFlag::LIQUIDITY_ALLOWED and PermissionFlag::SWAP_ALLOWEDSecuritize EVM Whitelister Audit Report · Cyfrin · 11 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalIncorrect use of msgSender()insteadof address(this)onquoterequestBridge Wormhole Executor Audit Report · Cyfrin · 10 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalMissing nonReentrant modifier on function executeVAAv1Bridge Wormhole Executor Audit Report · Cyfrin · 10 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalUSDCBridgeV2::quoteBridge returns inflated cost estimate by including wormhole core fee that Is never paid in CCTP v2 flowBridge Wormhole Executor Audit Report · Cyfrin · 10 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalUse SafeERC20 approval instead of standard IERC20 approve functionBridge Wormhole Executor Audit Report · Cyfrin · 10 Feb 2026Fixed
The report gives no description here.
Open the reportGasBetter storage packing by changing declaration orderSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Fixed
The report gives no description here.
Open the reportShow 10 more
GasCache storage to prevent identical storage readsSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Fixed
The report gives no description here.
Open the reportGasEmit events first to refactor away local variables storing previous valuesSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Fixed
The report gives no description here.
Open the reportGasIn Solidity don’t initialize to default valuesSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalMissing liquidityToken validation in CollateralLiquidityProvider::initializeSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalRedundant Access Control Check in SecuritizeInternal- NavProvider::addRateUpdater, removeRateUpdaterSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Fixed
The report gives no description here.
Open the reportGasRefactor away unnecessary local variables in SecuritizeAmm- NavProvider::_curveBuy, _curveSellSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalUse named mapping parameters to explicitly denote the purpose of keys and valuesSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Fixed
The report gives no description here.
Open the reportGasUse named return variables where this can refactor away local variablesSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalUse SafeERC20 approval and transfer functions instead of standard IERC20 functions for liquidityTokenSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Fixed
The report gives no description here.
Open the reportGasWhen emitting events don’t read known values from storageSecuritize Public Stock On/Off Ramp Audit Report · Cyfrin · 24 Dec 2025Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalUnnecessary use of emit_cpi! increases CU costSolana DSToken Whitelist Audit Report · Cyfrin · 7 Nov 2025Fixed
The report gives no description here.
Open the reportInformationalComplianceServiceGlobalWhitelisted::getComplianceTransferableTokens returns positive token amount for blacklisted usersGlobal Registry Audit Report · Cyfrin · 6 Nov 2025Fixed
The report gives no description here.
Open the reportInformationalDon’t emit misleading events when roles haven’t been added or revokedGlobal Registry Audit Report · Cyfrin · 6 Nov 2025Fixed
The report gives no description here.
Open the reportInformationalDon’t initialize to default valuesGlobal Registry Audit Report · Cyfrin · 6 Nov 2025Fixed
The report gives no description here.
Open the reportGasRemove redundant calls to EnumerableSet::containsGlobal Registry Audit Report · Cyfrin · 6 Nov 2025Fixed
The report gives no description here.
Open the reportGasRemove unused ExecutePreApprovedTransaction::nonceGlobal Registry Audit Report · Cyfrin · 6 Nov 2025Fixed
The report gives no description here.
Open the reportInformationalUse event indexing for faster off-chain parameter lookupGlobal Registry Audit Report · Cyfrin · 6 Nov 2025Fixed
The report gives no description here.
Open the reportGasCheaper not to cache calldata array lengthSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalComplianceServiceRegulated and its parent ComplianceService- Whitelisted uses a chain of initializer modifiers when calling the initializeSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportGasComplianceServiceRegulated::getComplianceTransferableTokens should call IDSLockManager::getTransferableTokensForInvestorSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalConsider reverting in RebasingLibrary functions if rounding down to zero occursSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportGasDon’t perform storage reads unless necessarySecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportGasDon’t write to the same storage slot multiple timesSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalEmit missing eventsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportGasFast fail without performing unnecessary storage reads or external callsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportGasMore efficient way of checking for empty string in CommonUtils::isEmptyStringSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalNot possible to rehash DOMAIN_SEPARATOR in MultiSigWallet to update chainId if is ever requiredSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportGasNot possible to send native via the TransactionRelayer to the target contract when executing executeByInvestorWithBlockLimitSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalPrefer ECDSA::tryRecover to using ecrecover directlySecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalPrefer explicit unsigned integer sizesSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalProtocol classifies retail investors based solely on whether they are qualified investors, without checking if they are accredited investorsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalRefactor away duplicated code between ComplianceService::newPreTransferCheck and preTransferCheckSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalRemove obsolete return statements when already using named return variablesSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportGasRemove return value from DSToken::updateInvestorBalance as it is never checkedSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportGasRemove setting deprecated lastUpdatedBy in RegistryServiceSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalRemove useless function ComplianceServiceRegulated::adjustTransferCountsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportGasReturn fast in ComplianceServiceRegulated::checkHoldUp if platform walletSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalSecuritizeSwap::buy should revert if stableCoinAmount is zeroSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalTransactionRelayer and SecuritizeSwap should use CommonUtils::encodeStringSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalUpgradeable contracts should call _disableInitializers in constructorSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportShow 10 more
GasUse calldata for read-only external inputsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalUse named importsSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalUse named mapping parameters to explicitly note the purpose of keys and valuesSecuritize DSToken Rebasing Audit Report · Cyfrin · 10 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalAdd a validation to check the message sender and the token valueFixed
The report gives no description here.
InformationalAvoid emitting unnecessary eventsFixed
The report gives no description here.
InformationalCode duplication in function overrides that only add modifiersFixed
The report gives no description here.
InformationalDelegation implementation may lead to inconsistenciesFixed
The report gives no description here.
InformationalEmit missing events on important parameter changesFixed
The report gives no description here.
GasFail fast without doing unnecessary workFixed
The report gives no description here.
InformationalFee collector field ambiguity wallet vs token accountFixed
The report gives no description here.
Show 10 more
InformationalFollow function declaration solidity style guide in BaseContractFixed
The report gives no description here.
InformationalInconsistent use of override keywordFixed
The report gives no description here.
InformationalIncorrect function documentationFixed
The report gives no description here.
InformationalIncorrect Loop Variable Type in _registerNewInvestorFixed
The report gives no description here.
InformationalIncorrect Maximum Holdings Check Prevents Valid TransfersFixed
The report gives no description here.
InformationalIncorrect reallocation wastes resources and increases account rentFixed
The report gives no description here.
InformationalIncorrect/misleading commentsFixed
The report gives no description here.
InformationalIncorrect/misleading comments (2) - SecuritizeVaultFixed
The report gives no description here.
InformationalInefficient use of dynamic array for fixed-length parametersFixed
The report gives no description here.
InformationalInvalid Zero Rate Not Rejected During DepositFixed
The report gives no description here.
Show 10 more
InformationalLack of checked arithmetical operation enforcementFixed
The report gives no description here.
InformationalLack of mut on liquidation_token_mint restricts redemption flexibilityFixed
The report gives no description here.
InformationalLack of validation in token revocation can lead to data inconsistenciesFixed
The report gives no description here.
InformationalLack of verification of the new delegate of the identity registryFixed
The report gives no description here.
InformationalMissing input validation in issueTokensWithNoCompliance functionFixed
The report gives no description here.
InformationalMissing Liquidity Vault Balance ValidationFixed
The report gives no description here.
InformationalMissing zero address validation in initialize functionFixed
The report gives no description here.
InformationalNaming improvementsFixed
The report gives no description here.
InformationalPossibility to add counters with duplicate IDs may lead to inconsistenciesFixed
The report gives no description here.
InformationalPossibility to remove incorrect countersFixed
The report gives no description here.
Show 10 more
InformationalPotential permanent tokens locked due to missing tracker total amount validationFixed
The report gives no description here.
InformationalProgram may panic due to index out of boundsFixed
The report gives no description here.
InformationalRedundant balance check in safeTransferFrom before calling underlying transfer functionFixed
The report gives no description here.
InformationalRedundant vault_authority_signer passed to BurnChecked in redeem and liquidateFixed
The report gives no description here.
GasRefactor SecuritizeBridge::bridgeDSTokens and quoteBridge to use internal function saves 2 storage reads per bridging transactionFixed
The report gives no description here.
GasRefactor SecuritizeBridge::validateLockedTokens to take dsServiceConsumer as input parameterFixed
The report gives no description here.
InformationalRemove unused function USDCBridgeV2::_redeemUSDCFixed
The report gives no description here.
InformationalRemove unused importsFixed
The report gives no description here.
InformationalResidual accounts left after mint closureFixed
The report gives no description here.
InformationalsetApprovalForAll() function is double initialized in the child contractFixed
The report gives no description here.
Show 10 more
InformationalSome comments are misleadingFixed
The report gives no description here.
InformationalSome function names are misleadingFixed
The report gives no description here.
InformationalSuperfluos requested accountsFixed
The report gives no description here.
GasUnnecessary _msgSender() call in _resolveVaultId when caller parameter is availableFixed
The report gives no description here.
GasUnnecessary gas consumption in deposit function due to redundant maximum deposit checkFixed
The report gives no description here.
GasUnnecessary modifierFixed
The report gives no description here.
InformationalUnused state variable in BaseSecuritizeSwap contractFixed
The report gives no description here.
InformationalUpgradeable contracts should call _disableInitializers in constructorFixed
The report gives no description here.
InformationalUse addressNotZero modifier on USDCBridgeV2::setBridgeAddressFixed
The report gives no description here.
InformationalUse named importsFixed
The report gives no description here.
Show 4 more
InformationalUse named mapping parameters to make explicit the purpose of keys and valuesFixed
The report gives no description here.
InformationalUse SafeERC20 approval and transfer functions instead of standard IERC20 functionsFixed
The report gives no description here.
GasUse targetAddress instead of bridgeAddresses[targetChain] for check in SecuritizeBridge::bridgeDSTokensFixed
The report gives no description here.
InformationalWrong/misleading commentsFixed
The report gives no description here.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="securitize"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us