Audits

The TxFlow bridge contract has been audited by OpenZeppelin.

The report lists each finding with its severity and the resolution.

"Resolved" in the report ≠ patched on Mainnet

The resolution status next to each finding records that TxFlow addressed it in the reviewed source and that OpenZeppelin accepted the response. It does not assert that the deployed Mainnet bytecode changed.

The Mainnet bridge, 0xcDE3F99bCB4c91e19124e41730489EAeFEc24565, is not upgradeable — no proxy, no admin-controlled implementation slot. Shipping a code change there means deploying a new contract and migrating the USDC it custodies, which moves user funds and interrupts deposits and withdrawals. For that reason some findings marked resolved in the report — including M-01 (updateValidatorSet can be replayed to block finalization) — are not reflected in the bytecode currently running on Arbitrum. TxFlow treats this as a known and accepted deployment constraint, not as an open unknown.

What stands in for the code change meanwhile:

• Operational containment. Lockers can vote to pause the bridge, and a cold-quorum emergencyUnlock rotates the validator set and restores operation. M-01's impact is bounded by exactly this path: a replayed updateValidatorSet can keep resetting the dispute period and block finalizeValidatorSetUpdate, forcing the rotation through emergencyUnlock — it cannot move or steal funds.
• Cold multi-signature control over validator-set rotation and emergency recovery, so the fallback route stays under the same quorum the bridge already trusts.
• A migration path to the fixed contract is being worked through internally, to be sequenced so custodied assets are not put at risk.

Reports on these specific findings are therefore already known to TxFlow and are not reward-eligible under the Bug Bounty Program — the program is still interested in anything outside them.

Everything below the bridge — matching, clearing, margin, and liquidation — runs inside the deterministic state machine rather than in contracts, and is verifiable a different way: any node can replay the block stream and confirm every balance, position, and fill for itself.