Security Audit Report for bitgetwallet's DeFiCard Contracts

The target of this audit is the private code repository of DeFiCard Contracts of bitgetwallet. The DeFiCard Contracts project introduces an on-chain payment card infrastructure that connects card-based payment workflows with ERC20 token settlement and optional DeFi protocol actions. Its core business logic covers authorisation, settlement, and refund flows, allowing payment amounts to be escrowed, released to settlement recipients, cancelled back to users, or refunded through designated refund callers. The architecture is built around DeFiCard Router, an entry contract that routes calls through enabled core implementations such as DeFiCardCoreV1 via fallback delegatecall. Each card is backed by a dedicated DeFiCardSettlement contract, and a handler integrates with DeFi protocols so payment flows can optionally use DeFi actions.

Please refer to the report for the detailed audit scope.

Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.

In summary, we did not find any critical issues within the audited codebase. However, we have identified some non-critical issues that should be addressed. Additionally, we have put forth recommendations and notes that should be taken into consideration. It is important to note that the scope of our audit was strictly limited to the specific code versions mentioned in the report. Any updates made subsequent to our review would require a re-evaluation.