YadaCoin Bridge Infrastructure
Zealynx audited the YadaCoin bridge, a BNB ↔ YadaCoin cross-chain bridge with a KERI-inspired key registry, native and ERC-20 wrapped tokens via beacon proxies, and an ERC-2612 permit-driven operation flow. The 1-week review identified 28 issues including 3 Criticals (zero-cost native drain, broken post-upgrade onboarding, and a permanent key pair registration revert) and 2 Highs (cross-permit msg.value reuse and unvalidated wrapped-token binding). All findings were fixed before mainnet deployment.
Total findings
28
28 fixed
Critical
03
High
02
Medium
04
Low + Info
19
02
Scope
7 files · 1,159 SLOCRepository
Initial commit
72bee2627de9
Platform
Bnb · Yadacoin · Solidity
Methodology
File
Bridge.sol
KeyLogRegistry.sol
MockERC20.sol
WrappedToken.sol
WrappedTokenBeacon.sol
WrappedTokenFactory.sol
WrappedTokenProxy.sol
03
Findings
click any row for the full write-upSeverity
ID
Finding
Status
04
Key Findings
- Zero-cost bridge drain via missing
msg.valuevalidation. ThetransferOnlyremainder path in the Bridge contract does not validatemsg.value, allowing any caller to drain the entire native balance of the bridge at zero cost. - Complete key pair registration failure post-upgrade. The
confirmingPublicKeyHashis derived from the wrong public key, causing every key pair registration to revert after the inception key. - New user onboarding regression in
registerKeyLog. A regression introduced during an upgrade broke theregisterKeyLogfunction for new users, preventing them from onboarding entirely. - Unbacked wrapped token minting via
msg.valuereuse. In permit-based batch operations, the samemsg.valueis accepted as valid collateral for multiple native wrap permits within a single transaction, enabling unbounded inflation of the wrapped token supply.
05
Architectural Security Observations
- KERI-based key event chain integrity.
KeyLogRegistryenforces strict chain integrity across key events, with uniqueness enforcement across all four index mappings. - Dual-signature key pair registration. Both unconfirmed and confirming keys must produce valid signatures with paired nonces.
- Atomic state transitions.
registerKeyPairWithTransfercombines key registration, token pair setup, permit execution, and ownership transfer in a single transaction. - Key-rotation-gated upgrades. The UUPS upgrade path
(
upgradeWithKeyRotation) is tied to the key rotation system rather than a simple owner call. - Beacon proxy pattern for wrapped tokens. Wrapped tokens are
deployed via
UpgradeableBeacon, enabling uniform upgrades across all deployed wrapped tokens. - Defense-in-depth on external calls.
SafeERC20,ReentrancyGuardUpgradeable, and the checks-effects-interactions pattern are applied consistently.
06
Security Strengths Observed
- Sound core key management design. The KERI-inspired key event log functions correctly. No critical vulnerabilities were found in this subsystem.
- Modern Solidity practices. Custom errors over
requirestrings,SafeERC20for token interactions, upgradeable contract patterns with initializers, and explicit reentrancy guards. - Findings concentrated in edge cases. The majority of issues relate to input validation gaps, inconsistent error handling, and edge cases around non-18-decimal tokens and native token handling.
- Controlled privilege model. Ownership transfer is gated by
KeyLogRegistryvalidation rather than a simpletransferOwnershipcall. - Clear separation of concerns. Modular design across
KeyLogRegistry,Bridge, andWrappedToken.
07
Team & approval
Lead Auditor
Carlos (Bloqarl)
@TheBlockChainer
Auditor
Bobby_Petrov
@0x_bob_0x
Auditor
derastephh
@derastephh
08
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.
