Skip to content
$1,000,000 in security audit grants are live now, Apply here →

Security review · June 2026

Liquidity Delivery Updates

for M0

Guardian's review of Liquidity Delivery Updates for M0, published June 2026. The report records 4 findings across 2 review rounds, including 1 low and 3 informational.

Published
Review window
May 19 to 30, 2026
Rounds
Main Review, Remediation Review
Language
Solidity, Rust
Chains
Ethereum, Arbitrum, Optimism, Linea, Unichain, Solana
Sector
Stablecoins
  • 0 Critical
  • 0 High
  • 0 Medium
  • 1 Low
  • 3 Informational

3 resolved · 1 acknowledged

Scope

Findings 4

Main Review

3 findings · May 19 to 26, 2026
  1. I-01 Informational NatSpec comments are stale Documentation Resolved
    Location
    evm/src/interfaces/IOrderBook.sol:62, evm/src/interfaces/IOrderBook.sol:171, evm/src/interfaces/IOrderBook.sol:205, evm/src/interfaces/IOrderBook.sol:349-351, evm/src/interfaces/IOrderBook.sol:363-365, evm/src/interfaces/IOrderBook.sol:382-384
    Round
    Main Review

    Description

    Some IOrderBook NatSpec comments are stale after recent order-opening changes. Order.sender and OrderData.sender are documented as the address that provided funds, but sender is now the order owner while the funder/msg.sender provides tokens. The cancelOrder() fee comments also refer to same-chain and cross-chain fills even though the section documents cancellations. Finally, OrderCompleted is documented as destination-chain-only, but it can also be emitted by reportFill() on the origin chain.

    Recommendation

    Update the NatSpec comments to describe sender as the order owner, distinguish it from funder, replace fill wording with cancel wording in cancelOrder() documentation, and clarify where OrderCompleted may be emitted.

  2. I-02 Informational Gasless cancel cannot be wrapped Informational Resolved
    Location
    evm/src/OrderBook.sol:242-246
    Round
    Main Review

    Description

    The removed cancelOrderFor() functionality cannot be replicated by a generic wrapper in the same way as gasless openOrder() flows. Before the deadline, cancelOrder() authorizes cancellation by checking that msg.sender is the order recipient or, for same-chain orders, the order sender. If a wrapper verifies a user signature and calls cancelOrder(), OrderBook sees the wrapper as msg.sender, so the call fails unless the wrapper itself is the authorized address.

    Setting the wrapper as recipient is not equivalent because fills transfer tokenOut directly to recipient without executing a callback. The wrapper would become a custody/accounting layer and would need additional forwarding, claiming, or off-chain keeper logic to route filled funds to the actual user.

    Recommendation

    Make sure this is intentional. If it's not - consider having the gasless cancel feature back in the OrderBook.

  3. I-03 Informational Filling native orders may fail Warning Acknowledged
    Location
    svm/programs/order_book/src/instructions/fill.rs:82-159
    Round
    Main Review

    Description

    After compiling the orderbook, the FillNativeOrder tests should be checked for success.

    Currently, the plan is to compile the program using Solana v2.1.0 and Anchor v0.31.1. However, for different versions of the toolchain, the following issue may materialize:

    The SVM FillNativeOrder account context is too large for SBF stack limits. During anchor build, the compiler reports that the generated FillNativeOrder::try_accounts() frame uses a stack offset of 4112, exceeding the 4096 byte maximum. The generated parser then traps at runtime before handler() can execute successfully. Any native same-chain fill_native_order() call fails with ProgramFailedToComplete and an access violation.

    As a result, SVM same-chain orders cannot be filled. Solvers cannot deliver the recipient's token_out and receive the escrowed token_in; users are forced into cancellation/refund paths, and same-chain liquidity delivery is unavailable on SVM.

    Recommendation

    Make sure the right toolchain was used and the tests are passing before deploying the program.

Remediation Review

1 finding · May 30, 2026
  1. L-01 Low Cancel TYPEHASH diverges from EIP-712 Compatibility Resolved
    Location
    evm/src/OrderBook.sol:59-60
    Round
    Remediation Review

    Description

    The preimage of the CANCEL_ORDER_TYPEHASH includes whitespaces after the commas that separate each struct element.

        /// @dev keccak256("CancelOrder(bytes32 orderId, address bridgeAdapter, bytes bridgeAdapterArgs)")
        bytes32 public constant CANCEL_ORDER_TYPEHASH = 0x6919f4958bcd1b5b4e13b800c6d41c4792cfc2a12d0bd9ad19da6e0bfe8ac04f;
    

    This implementation is not true to the EIP-712 specification, where the whitespaces are omitted.

    Recommendation

    Consider using EIP-712 compliant digest if it won't break already existing integrators.

More from M0

All 10 reports
  1. PYUSDX

    21 findings 21 findings: 8 low, 13 informational
  2. Liquidity Delivery

    59 findings3 critical · 5 high 59 findings: 3 critical, 5 high, 10 medium, 14 low, 27 informational
  3. M Extensions Updates

    16 findings 16 findings: 1 medium, 5 low, 10 informational
  4. USD8

    10 findings1 high 10 findings: 1 high, 1 low, 8 informational

Put your code through the same review.

This review started with a conversation about scope. Tell us what you are building and we will plan yours with you.

Get a quote