Security Assessments

Technical security assessments of protocols covered by Quantix Protocol Research. Each one documents the architecture and trust assumptions, the threat model, every finding with its exploit scenario and fix, and the remediation state at a stated commit. Completed assessments are published as Technical Security Assessment documents you can download. They are Quantix research assessments, not client engagements or certifications.

Browse the catalogue Technical publications

Illustration: a technical assessment report with a severity distribution and findings table, beside the in-scope contracts inside a brass scope frame.

Assessments: 12
Published documents: 9
Findings documented: 90
Ecosystems covered: 10
Overall remediation: 87%

Catalogue

All assessments

Search across protocols, document IDs, finding titles and vulnerability classes. Filters combine; the quick view summarises an assessment without leaving the catalogue.

12 assessments · page 1 of 2

Workspace

Assessment workspace

Follow one assessment through its seven stages, see how its findings break down by severity and remediation status, and export the findings table as CSV.

Arbalest Bridge

QX-TSA-2026-005 · v0.9 · d9e6c02925a9

Under ReviewBridge Security Assessment

Assessment

Assessment stages

5 of 7 complete · review 21 Sept 2026 – 6 Oct 2026

Stage 1, complete:21 Sept 2026ScopingRepository, commit and in-scope files agreed.
Stage 2, complete:CompleteArchitecture reviewComponents, trust levels and assumptions mapped.
Stage 3, complete:CompleteThreat modellingAssets, actors and threats enumerated.
Stage 4, complete:6 Oct 2026Review and testingManual review, tooling, fuzzing and verification.
Stage 5, complete:6 Oct 2026ReportingFindings written with exploit scenarios and fixes.
6Stage 6, in progress:In progressRemediation reviewFix commit reviewed finding by finding.
7Stage 7, not started:PendingPublicationTechnical Security Assessment document generated.

Findings by severity

8findings

Remediation by severity

69% remediated · 3 open or partial

ResolvedPartially resolvedAcknowledgedOpen

Arbalest Bridge findings by severity and remediation status
Category	Resolved	Partially resolved	Acknowledged	Open
Critical	1	0	0	0
High	1	1	0	0
Medium	0	0	1	2
Low	1	0	0	0
Informational	1	0	0	0

Search findings

Severity

Status

8 of 8 findings shown

Findings of Arbalest Bridge
ID	Finding	Severity	L / I	Status
AB-01	Duplicate signatures are counted towards the thresholdBridge message validation · CWE-347	Critical	H / H	Resolved
AB-02	Message digest omits destination chain and receiver contractSignature replay · CWE-294	High	M / H	Resolved
AB-03	Signed validator-set updates can be replayed after rotationSignature replay · CWE-294	High	M / H	Partially resolved
AB-04	Vault accounting assumes the full amount arrivesBusiness logic · CWE-682	Medium	M / M	Open
AB-05	Fixed-window rate limiter allows double the cap at window boundariesBusiness logic	Medium	L / H	Acknowledged
AB-06	Signature recovery accepts malleable signaturesCryptography · CWE-347	Low	L / L	Resolved
AB-07	Pause and unpause emit no eventsCode quality	Informational	L / L	Resolved
AB-08	Validator rotation takes effect immediatelyGovernance manipulation	Medium	L / H	Open

Open assessment

Reading an assessment

An assessment covers one commit. It is evidence about that code under stated assumptions, not a statement that a protocol is secure.

01Compare the commit. Check the reviewed and remediation commits against the code you are actually integrating.
02Read status, not counts. A resolved critical finding and an open medium one carry different residual risk. The remediation analysis shows both.
03Check the trust assumptions. The architecture section lists what the review assumed to be trusted. Anything outside it was not tested.

Technical publications Assessment methodology Protocol security profiles

Commission an assessment you can publish.

Every Quantix assessment is written to be checked: scope, method, findings, fixes and limitations, with commit references anyone can compare.

Request an Audit See the methodology

Security Assessments

All assessments

Arbalest Bridge

Fenwick Lending

Northstar Custody

Merivale Markets

Larkspur Wallet SDK

Axeline Bridge