OpenZeppelin audited the arcus-xyz/rootchain-contracts repository (commit e950dbc) from June 1 to June 12, 2026. The system comprises the EVM-side bridge contracts connecting a rootchain to a sidechain running a hybrid perpetuals exchange. Key components include BridgeVault (custodian of bridged ERC-20 funds), CheckpointManager (orchestrator of the bridge and escape hatch), ValidatorConsensus (on-chain voting gate), ValidatorBeacon (signaling registry), and EmergencySettlement (stateless proof verifier). The audit found 13 total issues (12 resolved), with 5 low-severity findings (4 resolved) and 8 notes (all resolved). No critical, high, or medium severity issues were identified. Main findings include vote retraction not invalidating outstanding meta-transaction vote signatures, missing zero-value parameter validation, permissionless raw inbox requests impersonating typed deposit requests, potential stranded funds in emergency-settlement payouts, and deposits to zero-address owner causing fund loss. The security model delegates exchange state correctness to a trusted validator set, with rootchain contracts enforcing transport-level invariants and custody solvency.

Key facts

• 13 total findings (12 resolved), no critical/high/medium issues.
• Low-severity: Vote retraction doesn't invalidate outstanding meta-transaction signatures.
• Low-severity: Missing zero-value validation; permissionless raw requests can impersonate deposits.
• Low-severity: Emergency-settlement payouts may strand funds if recipient-only; zero-address deposits risk loss.
• Security model trusts validator quorum for exchange state correctness; rootchain handles transport & custody.