Security Audit Report for PopDEX's Bridge Contracts

The target of this audit is the private code repository of Bridge Contracts of PopDEX. The DexChain Bridge implements a Hub-and-Spoke cross-chain bridge architecture consisting of native Rust precompiled contracts on the Hub chain (Core) and Solidity upgradeable contracts on each Spoke chain (EVM). On the Hub side, three Rust modules are deployed as native precompiles: MessageGateway at 0x1001, which handles inbound message verification, hot/cold verifier signature validation, replay protection, and verifier set management; TokenBridge at 0x100f, which manages user withdrawals, deposit execution, and governance configuration synchronization to Spoke chains; and common, which provides shared utilities including EIP-712 digest construction. On the Spoke side, the bridge is implemented through Solidity UUPS-upgradeable contracts. MessageGateway.sol is responsible for receiving and validating cross-chain messages from the Hub chain, enforcing message execution rules, replay protection, and authorized gateway interactions. TokenBridge.sol manages token deposit and withdrawal flows on the Spoke chain, including locking or releasing bridged assets, initiating outbound bridge messages to the Hub, executing inbound bridge instructions, and applying bridge-related governance or configuration updates propagated from the Hub.

Please refer to the report for the detailed audit scope.

Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.

In summary, we have found that the codebase contains 2 high-risk issues that require prompt attention. In addition, we have identified other non-critical issues as well as recommendations and notes that should be considered. The Bridge Contracts team has addressed these issues promptly. It is important to note that our audit covers only the final reported versions of the codebase. Any subsequent updates would require a re-evaluation.