PWRAuctionCrossChain Audit Report
The PWRAuctionCrossChain audit follows bidding, buyer identity, token claims, vesting, and administrative escrow controls across contract boundaries. The final table records four high and two medium findings as resolved, with one low and one informational finding acknowledged.
Report Summary
The PWRAuctionCrossChain audit follows bidding, buyer identity, token claims, vesting, and administrative escrow controls across contract boundaries. The final table records four high and two medium findings as resolved, with one low and one informational finding acknowledged.
Original and fixed archives
The scope section names the initial pwrAuctionCrossChain.zip archive and the fixed pwrAuctionCrossChainv2.zip archive, with identifiers in the original PDF. The findings refer to Auction.sol, BidCollector.sol, TokenVesting.sol and PWR token interactions. This is application-contract evidence, not an audit of an entire cross-chain messaging network. Source: PDF page 4.
Claims, vesting and buyer identity
The high-severity findings include a mismatch between the destination-chain distributor and the vesting contract's expected caller, plus buyer metadata populated from the messaging endpoint instead of the message payload. The report describes corrected holder configuration and payload-based buyer fields in the fixed version. Source: PDF page 7.
Escrow controls and recovery
The report records stronger escrow-drain conditions, including a halted and ended sale plus a delayed two-step process. It also describes a retry path for vesting so that a failed vesting call does not undo the immediate claim transfer. These fixes illustrate why permissions and failure recovery belong in a cross-chain application review. Source: PDF page 9.
Transfer handling and final status
Medium-severity fixes address token-transfer failure handling and the ordering of fund collection, buyer-state updates and message submission. The final summary marks high and medium findings resolved, while low and informational findings remain acknowledged. Read those statuses with the source archive and report limitations. Source: PDF page 12.
How to Evaluate This Report
Check the original PDF for the code version, reviewed components, exclusions, and remediation status. An audit applies to its documented scope; it does not automatically cover later upgrades or changes to external dependencies.
Planning a similar review? Compare our audit methodology and scope checklist, then discuss your project with CTDSEC.
| Project | PWRAuctionCrossChain |
|---|---|
| Review type | Solidity cross-chain auction review |
| Scope | Auction, BidCollector, TokenVesting and PWR token interactions in the supplied pwrAuctionCrossChain archives |
| Report source | Featured public PDF |
| Source file | Cybersecurity_Audit_CTDSEC_PWRAuctionCrossChain_PASS.pdf |
| Source archives | pwrAuctionCrossChain.zip; fixed archive: pwrAuctionCrossChainv2.zip |
Severity Summary
Counts and statuses reflect the public PDF's findings and final summary, not a new assessment of the current deployment.
Check the original final summary on PDF page 12. Acknowledged findings are not verified fixes.
Open the Public Report
Use the original PDF for complete context, exact wording, and detailed remediation notes.
Planning a similar review?
Request a smart contract audit for your protocol
Send the repository, target network, language, and launch timeline so CTDSEC can scope your audit accurately.