Prepared by:
HALBORN
Last Updated 09/15/2025
Date of Engagement: August 21st, 2025 - August 22nd, 2025
100% of all REPORTED Findings have been addressed
All findings
20
Critical
0
High
0
Medium
2
Low
5
Informational
13
The security assessment was commissioned by ZKCross, a cross-chain interoperability protocol focused on DeFi infrastructure, to assess the security and robustness of the Solidity-based EVM Swapper smart contract. The assessment was performed by Halborn’s experienced security team, focusing on the code released at commit 0264b30. The review covered all functionality in Swapper.sol between August 21st, 2025, and August 22nd, 2025. The primary objective of this engagement’s core purpose was to identify vulnerabilities, ensure protocol reliability and strengthen overall security.
The team at Halborn assigned a full-time security engineer to verify the security of the smart contracts. The security engineer is a blockchain and smart-contract security expert with advanced penetration testing, smart-contract hacking, and deep knowledge of multiple blockchain protocols.
The purpose of this assessment is to:
Ensure that smart contract functions operate as intended
Identify potential security issues with the smart contract
In summary, Halborn identified some improvements to reduce the likelihood and impact of risks, which were properly addressed by the ZKCross team. The main recommendations were the following:
Reinstate the check to ensure that the caller of the swap function is the one whose funds are being used.
Use call() pattern with success check instead of transfer() when transferring funds.
Add slippage control to the swap function.
Measure the token balance before and after transfer, then approve the allowanceHolder for the actual amount received instead of the nominal amount.
A layered and exhaustive approach was adopted. Initial research mapped contract design objectives and expected operating scenarios. Manual code reviews targeted privilege boundaries, fund flows, and feature completeness, with particular scrutiny of administrative and edge-case logic. Automated static analysis and dynamic on-chain test suites were executed to cover functional correctness, failure conditions, and integration with external token contracts.
The methodology balanced deep manual analysis with rigorous automated tools. Multiple stages were conducted: reconnaissance, manual threat modeling, static analysis, custom test building, and scenario-driven on-chain transaction simulations. This combination ensured broad and deep coverage, surfacing both logical flaws and implementation oversights across all critical paths.
| EXPLOITABILITY METRIC () | METRIC VALUE | NUMERICAL VALUE |
|---|---|---|
| Attack Origin (AO) | Arbitrary (AO:A) Specific (AO:S) | 1 0.2 |
| Attack Cost (AC) | Low (AC:L) Medium (AC:M) High (AC:H) | 1 0.67 0.33 |
| Attack Complexity (AX) | Low (AX:L) Medium (AX:M) High (AX:H) | 1 0.67 0.33 |
| IMPACT METRIC () | METRIC VALUE | NUMERICAL VALUE |
|---|---|---|
| Confidentiality (C) | None (C:N) Low (C:L) Medium (C:M) High (C:H) Critical (C:C) | 0 0.25 0.5 0.75 1 |
| Integrity (I) | None (I:N) Low (I:L) Medium (I:M) High (I:H) Critical (I:C) | 0 0.25 0.5 0.75 1 |
| Availability (A) | None (A:N) Low (A:L) Medium (A:M) High (A:H) Critical (A:C) | 0 0.25 0.5 0.75 1 |
| Deposit (D) | None (D:N) Low (D:L) Medium (D:M) High (D:H) Critical (D:C) | 0 0.25 0.5 0.75 1 |
| Yield (Y) | None (Y:N) Low (Y:L) Medium (Y:M) High (Y:H) Critical (Y:C) | 0 0.25 0.5 0.75 1 |
| SEVERITY COEFFICIENT () | COEFFICIENT VALUE | NUMERICAL VALUE |
|---|---|---|
| Reversibility () | None (R:N) Partial (R:P) Full (R:F) | 1 0.5 0.25 |
| Scope () | Changed (S:C) Unchanged (S:U) | 1.25 1 |
| Severity | Score Value Range |
|---|---|
| Critical | 9 - 10 |
| High | 7 - 8.9 |
| Medium | 4.5 - 6.9 |
| Low | 2 - 4.4 |
| Informational | 0 - 1.9 |
Critical
0
High
0
Medium
2
Low
5
Informational
13
| Security analysis | Risk level | Remediation Date |
|---|---|---|
| Third-party Can Trigger swap on Behalf of a User | Medium | Solved - 09/09/2025 |
| Funds Can Be Stuck for Smart Contract Recipients | Medium | Solved - 09/09/2025 |
| No Slippage Control In swap | Low | Solved - 09/09/2025 |
| Fee-on-Transfer/Deflationary Token Incompatibility | Low | Solved - 09/09/2025 |
| Missing Two-Step Ownership Transfer Pattern | Low | Solved - 09/09/2025 |
| User Funds Stuck Without Recourse When Cross-Chain Transfer Fails | Low | Solved - 09/12/2025 |
| Missing Storage Gap | Low | Solved - 09/09/2025 |
| Typographical Errors and Inconsistencies | Informational | Solved - 09/09/2025 |
| Missing explicit allowanceHolder zero-address check in lock/release | Informational | Solved - 09/09/2025 |
| Swap Functionality Can Be Permanently Disabled | Informational | Solved - 09/09/2025 |
| Risk of Irrecoverable Fund Loss in withdrawTokens | Informational | Solved - 09/09/2025 |
| Missing Events for Critical Admin Actions | Informational | Solved - 09/09/2025 |
| Raw ERC20 Transfer In lock | Informational | Solved - 09/09/2025 |
| Stale ERC20 Approvals Can Enable Unintended Token Pulls | Informational | Solved - 09/09/2025 |
| Processed Lock Hash Keyed By String | Informational | Solved - 09/09/2025 |
| Dead Code | Informational | Solved - 09/12/2025 |
| Unlocked Pragma | Informational | Solved - 09/09/2025 |
| Usage of Revert Strings Instead of Custom Error | Informational | Solved - 09/09/2025 |
| Redundant Validations After `_decode` Increase Gas and Code Complexity | Informational | Solved - 09/09/2025 |
| Test Suite Failures | Informational | Solved - 09/12/2025 |
//Medium
//Medium
//Low
//Low
//Low
//Low
//Low
//Informational
//Informational
//Informational
//Informational
//Informational
//Informational
//Informational
//Informational
//Informational
//Informational
//Informational
//Informational
//Informational
Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.
// Download the full report
EVM Stellar zkCrossDex
* Use Google Chrome for best results
** Check "Background Graphics" in the print settings if needed
