# Trestle wTIA Bridge audit Three Sigma · Modular blockchain infrastructure · 27th January 2024 A private security review of Trestle (modular blockchain infrastructure), conducted with Three Sigma and completed on 27th January 2024 over 3 days. 0xSimao disclosed 14 findings: 1 high severity, 7 medium, 5 low and 1 informational. ## What Trestle is Trestle connects Celestia's modular network with Ethereum's protocols and users: a bridge between the two chains that brings Wrapped TIA (wTIA) to Ethereum for trading and building on the asset. ## Scope A three-day Three Sigma review of the bridge pair: the wTIA token contract and the Trestle bridge logic that mints it on arrival and releases it on the way back. ## Findings ### High - [Distribute is permissionless, allowing malicious users to specify 0 slippage and sandwich the swap](https://0xsimao.com/findings/trestle-permissionless-specify-slippage-sandwich) ### Medium - [Stuck tokens due to not using SafeTransfer](https://0xsimao.com/findings/trestle-stuck-tokens-safe-transfer) - [Swaps should use the deadline argument on top of minimumAmountOut](https://0xsimao.com/findings/trestle-deadline-argument-top-minimum) - [On tax sells, swaps are vulnerable to MEV](https://0xsimao.com/findings/trestle-tax-sells-vulnerable-mev) - [createAmmPairWith() in initialize() will revert if the pair already exists](https://0xsimao.com/findings/trestle-initialize-revert-already-exists) - [Amounts to distribute are added directly to tokenPerShare, skipping using rewardPerToken](https://0xsimao.com/findings/trestle-amounts-share-skipping-reward) - [Possible to mint or burn infinite shares, stealing all rewards or making transfers fail](https://0xsimao.com/findings/trestle-mint-shares-rewards-transfers) - [address(0) can be added as a pair, triggering taxes on burn](https://0xsimao.com/findings/trestle-address-triggering-taxes-burn) ### Low - [totalShares update should add before reducing to avoid underflows](https://0xsimao.com/findings/trestle-shares-reducing-avoid-underflows) - [Users may send tokens before the dead block period to an address to blacklist it](https://0xsimao.com/findings/trestle-dead-block-period-blacklist) - [Native transfers should use Openzeppelin's .sendValue()](https://0xsimao.com/findings/trestle-native-transfers-openzeppelin-value) - [Missing events](https://0xsimao.com/findings/trestle-missing-events) - [Ownable2Step is preferred over Ownable](https://0xsimao.com/findings/trestle-ownable2-step-preferred-ownable) ### Informational - [Storage variables can be cached](https://0xsimao.com/findings/trestle-storage-variables-cached) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2024-01-27-trestle.pdf)