Search results

[INFO] docs/api-reference.md and docs/architecture.md were not checked against the salt-collision or nonce-bypass bugs above

area:documentation

contract-audit

severity:info

Status: Open.

#432 In bridgelet-org/bridgelet-core;

· phertyameen opened on Jul 25, 2026

[MEDIUM] No integration test exercises the full create -> fund -> sweep pipeline across all three live contracts together

area:cross-contract

contract-audit

severity:medium

Status: Open.

#431 In bridgelet-org/bridgelet-core;

· phertyameen opened on Jul 25, 2026

[HIGH] AccountInitRequest has no room for per-account authorized_controller/admin, forcing the hardcoding bug in account_factory

area:cross-contract

contract-audit

severity:high

Status: Open.

#430 In bridgelet-org/bridgelet-core;

· phertyameen opened on Jul 25, 2026

[LOW] Four independent Error enums with overlapping #[repr(u32)] discriminants and no cross-contract namespacing

area:cross-contract

contract-audit

severity:low

Status: Open.

#429 In bridgelet-org/bridgelet-core;

· phertyameen opened on Jul 25, 2026

[INFO] reserve_contract is the only contract with correct TTL handling, access control, and bounds checking — and it's unused

area:reserve-contract

contract-audit

severity:info

Status: Open.

#428 In bridgelet-org/bridgelet-core;

· phertyameen opened on Jul 25, 2026

[MEDIUM] account_factory never extends instance storage TTL either

area:account-factory

contract-audit

severity:medium

Status: Open.

#427 In bridgelet-org/bridgelet-core;

· phertyameen opened on Jul 25, 2026

[INFO] Cargo.lock is committed for two of the four contract crates but not the other two

area:account-factory

contract-audit

severity:info

Status: Open.

#426 In bridgelet-org/bridgelet-core;

· phertyameen opened on Jul 25, 2026

[LOW] Errors from failed account initialization are silently discarded

area:account-factory

contract-audit

severity:low

Status: Open.

#425 In bridgelet-org/bridgelet-core;

· phertyameen opened on Jul 25, 2026

[CRITICAL] batch_initialize hardcodes authorized_controller and admin to the creator address for every deployed account

area:account-factory

contract-audit

severity:critical

Status: Open.

#424 In bridgelet-org/bridgelet-core;

· phertyameen opened on Jul 25, 2026

[HIGH] account_factory's single test doesn't call batch_initialize or assert anything

area:account-factory

contract-audit

severity:high

Status: Open.

#423 In bridgelet-org/bridgelet-core;

· phertyameen opened on Jul 25, 2026

[CRITICAL] batch_initialize's deployment salt collides across every call, bricking the factory after first use

area:account-factory

contract-audit

severity:critical

Status: Open.

#422 In bridgelet-org/bridgelet-core;

· phertyameen opened on Jul 25, 2026

[CRITICAL] account_factory::initialize has no auth check and no already-initialized guard

area:account-factory

contract-audit

severity:critical

Status: Open.

#421 In bridgelet-org/bridgelet-core;

· phertyameen opened on Jul 25, 2026