A Checklist for Auditing Cross-Chain Transfer Logic

Before merging bridge integration code to production, walk through these questions with your team. They reflect failure modes we have documented in incident reports and reader briefing sessions since 2019.

Program and address verification

1. Are you calling the current mainnet program ID, verified against the bridge operator's official documentation?
2. Do you hardcode mint addresses, or fetch them from a config that can be updated without redeployment?
3. Have you tested against a deprecated program ID to confirm your app rejects it?

Finality and timing

4. Does your code wait for sufficient finality on the source chain before acting on Solana?
5. What happens if a source-chain reorg invalidates a previously accepted transfer?
6. Do you handle partial finality states explicitly, or assume binary confirmed/unconfirmed?

Amount and accounting

7. Are decimal conversions handled correctly between chains with different token precision?
8. Do you protect against integer overflow in amount calculations?
9. Is there a maximum transfer limit, and who sets it?

Failure and recovery

10. If minting succeeds but the user never receives tokens, what is your support runbook?
11. Can users reverse or cancel an in-flight transfer?
12. Do you log transfer state transitions for post-incident forensics?

Trust assumptions

13. Which parties must behave honestly for the transfer to succeed?
14. Do you depend on a specific relayer, or can any party submit proofs?
15. Have you read the bridge's most recent audit report and noted unresolved findings?

User-facing clarity

16. Does your UI show estimated completion time with realistic bounds?
17. Do you distinguish wrapped tokens from native Solana assets in labels?
18. Are fees on both chains displayed before the user confirms?

Testing

19. Have you tested with mainnet-fork or devnet equivalents for each chain?
20. Do integration tests cover rejected VAAs and malformed proofs?
21. Have you simulated guardian downtime or relayer censorship?

Operational readiness

22. Who monitors bridge operator announcements for program upgrades?
23. Is there an incident contact if the bridge pauses during your user's transfer?

This checklist is a starting point, not a substitute for professional security audit. Teams have used it alongside our glossary during onboarding. Questions? Contact us.