Audit
The independent security reviews of the Memora bridge by Halborn, what each covered, and how to read them.
Halborn, an independent blockchain security firm, reviewed the Memora bridge across three separate engagements. Each covered a different part of the system and produced its own report.
Engagements
| Engagement | What was reviewed | Report |
|---|---|---|
| Solana smart contracts | The vault on Solana: custody of locked funds, the deposit instruction and fee split, threshold verification on releases and refunds, replay protection, the pause mechanism, and configuration authority. | Coming soon |
| Daml smart contracts | The mint path and its attestation threshold, the burn and redemption path, the processed and refunded registries, the offer and re-offer logic, and the party authority model. | Coming soon |
| Relayer penetration test | The off-chain relayer that carries transfers between chains, tested as a running system rather than read as source: its exposed surface, its handling of untrusted input, and its behavior under failure. | Coming soon |
Halborn scoped and reported each engagement separately, so a reader checking one component does not have to read past the others. All three are complete. Halborn has not yet published the reports on its site. We will link each here once it does, and partners can request them from inquiries@memora.systems in the meantime.
Audited versions
| Engagement | Version reviewed | Date |
|---|---|---|
| Solana smart contracts | Coming soon | Coming soon |
| Daml smart contracts | Coming soon | Coming soon |
| Relayer penetration test | Coming soon | Coming soon |
Match these against the deployed vault and package on Verified Deployments before relying on a report. An audit covers the version it names and nothing later.
Findings and resolution
We resolved all findings raised during the three engagements before launch. The reports record what Halborn found and how each item was closed.
How to read an audit report
An audit is a point-in-time review of specific code. It does not certify code written afterward, and it does not cover partner systems, wallets or the underlying networks. A penetration test is narrower still: it reports what was reachable and exploitable from outside during the test window, on the deployment as it stood.
Read the findings table together with the resolution notes rather than counting severities. A finding's severity describes what it could have allowed. Its resolution note says whether it was closed before launch.
Ongoing review
Material changes to a vault or to the Canton contracts are reviewed before deployment, and we update this page with each new report. Each origin chain has its own vault, so adding a chain adds a vault to review, along with the Canton and relayer changes that support it. We list those engagements here with their versions and dates. Independent researchers can report issues to inquiries@memora.systems.