GoAT-X: A Graph of Auditing Thoughts for Securing Token Transactions in Cross-Chain Contracts

Cross-chain bridges, the critical infrastructure of the multi-chain ecosystem, have become a primary target for attackers, resulting in over $2.8 billion in losses due to subtle implementation flaws. Existing defenses, such as bytecode-level static analysis, are ill-equipped to handle the semanti...

CVE-2025-46834

Alchemy's Modular Account is a smart contract account that is compatible with ERC-4337 and ERC-6900. In versions on the 2.x branch prior to commit 5e6f540d249afcaeaf76ab95517d0359fde883b0, owners of Modular Accounts can grant session keys scoped external keys to external parties and would use the...

Malicious code in rif-token-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05165c539111a84ce983abfe2dbe4cadf7b601ad72a0676be43e8c101e5fc752 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3116 Malicious code in rif-token-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05165c539111a84ce983abfe2dbe4cadf7b601ad72a0676be43e8c101e5fc752 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Contracts are vulnerable to fee-on-transfer accounting-related issues

Lines of code 359, 448, 509, 530, 42, 797, 162 Vulnerability details The functions below transfer funds from the caller to the receiver via transferFrom, but do not ensure that the actual number of tokens received is the same as the input amount to the transfer. If the token is a fee-on-transfer...

use safeERC20

Lines of code Vulnerability details Impact Some tokens contracts like USDT don't comply with the erc20 standard, the transfer doesn't return a boolean. Proof of Concept Tools Used Recommended Mitigation Steps Use the safeErc20 library from OpenZeppelin. --- The text was updated successfully, but...