Following a February incident affecting one of its bridge components, CrossCurve has taken an active step toward strengthening its broader cross-chain architecture, completing a smart contract audit with Web3 security firm Hashlock on its LayerZero-based OFT messaging contracts. The audit, finalised in March 2026, resulted in a “Secure” rating, with all identified vulnerabilities resolved within scope.
The engagement reflects a wider effort by the CrossCurve team to harden the security posture of its MetaLayer infrastructure beyond the contracts directly involved in the earlier incident, reinforcing trust across the protocol’s cross-chain messaging stack.
What Is CrossCurve?
CrossCurve is a cross-chain execution layer for DeFi, aggregating liquidity from leading protocols — including 90+ DEXs, 40+ bridges, and intent-based solutions — into a unified routing system, enabling seamless any-token-to-any-token swaps across chains with optimized pricing and minimal slippage.
The protocol combines:
- cross-chain aggregators
- token bridge and messaging infrastructure
- liquidity aggregated from local decentralized exchanges (DEXs)
It provides Web3 projects with integration-ready infrastructure for seamless cross-chain operations — supporting gasless and private transactions, ZAP operations, and AI-agent compatibility.
This eliminates cross-chain complexity, reducing the user experience to a single click.
Audit Scope
Hashlock conducted a manual, line-by-line review of CrossCurve’s OFT messaging contracts on Ethereum, supported by software-assisted testing. The scope included five contracts that together govern how CrossCurve routes cross-chain token transfers through the LayerZero OFT framework:
CrossCurveCore.sol, the core contract extending LayerZero’s OFTCore and routing CrossCurve-enabled destinations through the protocol’s GateKeeper. OFTAdapter.sol and MintBurnOFTAdapter.sol, the two adapter variants responsible for locking and unlocking, or burning and minting, tokens on cross-chain transfers. CrossCurveOFTStorage.sol, a transient storage library managing the current CrossCurve message context. And OptionsReader.sol, a library handling LayerZero executor options for fee calculation.
Each contract was reviewed against its intended functionality, with Hashlock confirming all five behave as specified.
Findings and Resolution
Hashlock’s review identified one medium-severity issue, three low-severity issues, and one QA finding. All have been resolved.
The medium finding centred on the routing logic in CrossCurveCore, where native value sent by a caller could become locked under specific conditions if a destination was switched to the CrossCurve path between quoting and execution. The fix was straightforward but meaningful, the kind of edge-case issue that surfaces only through careful manual review of cross-chain routing logic. The remaining findings covered missing event emissions on the CrossCurve path, a missing selector validation in the cross-chain authentication flow, an uninitialised return struct, and an unused storage constant.
After remediation, Hashlock awarded the contracts a “Secure” rating, with the report noting the codebase follows industry best practices, makes appropriate use of OpenZeppelin libraries, and is well documented.
From Incident to Hardened Infrastructure
Cross-chain protocols have historically been one of the most targeted layers in DeFi, with bridge exploits accounting for some of the largest losses in the sector’s history. The February incident affecting CrossCurve’s Axelar receiver contract, which resulted in approximately $1.4M in losses, underscored how implementation-level flaws in cross-chain validation logic can have outsized consequences.
The decision to audit a separate cross-chain messaging path reflects a more mature security posture, treating bridge architecture as a continuous attack surface rather than a one-time deployment. By bringing in Hashlock to review the LayerZero OFT layer, CrossCurve is reinforcing trust in the components that route user transfers across its 20-plus supported chains.
Why Bridge Security Matters
Cross-chain infrastructure remains a structurally high-risk surface in DeFi. Messaging logic, access control on receiver contracts, and quorum configurations are all areas where small oversights can lead to large-scale exploits. As liquidity continues to flow across an expanding set of chains, the protocols that earn long-term user trust will be those that treat security as iterative, with regular reviews of evolving components rather than a single pre-launch checkpoint.
For projects building or integrating with cross-chain infrastructure, the CrossCurve engagement offers a template: respond to incidents by widening the scope of independent review, not narrowing it.
Looking Ahead
With the OFT messaging contracts reviewed and findings resolved, CrossCurve is positioned to continue rolling out its MetaLayer architecture across additional chains while maintaining a strengthened security baseline. The team has signalled ongoing investment in security across its broader stack, including continued external review of cross-chain components.
Resources
Hashlock audit page: hashlock.com/audits/crosscurve
CrossCurve website: crosscurve.fi
CrossCurve documentation: docs.crosscurve.fi
About Hashlock
Hashlock is a Web3 security firm specializing in smart contract auditing and blockchain cybersecurity. Hashlock has conducted more than 200 audits and helped secure over 1.3 billion dollars in onchain value across DeFi, infrastructure, gaming, and enterprise blockchain systems.
Website: https://hashlock.com/
About CrossCurve
CrossCurve is a cross-chain execution layer for DeFi, aggregating liquidity from leading protocols — including 90+ DEXs, 40+ bridges, and intent-based solutions — into a unified routing system.
It enables seamless any-token-to-any-token swaps across supported networks, while providing Web3 projects with integration-ready infrastructure for cross-chain operations, including gasless and private transactions, ZAP operations, and AI-agent compatibility.
Website: crosscurve.fi
