Skip to main content
IBC has been audited by multiple independent security firms and engineers. Reports are published in the following repositories:

​
Protocol

Covers the IBC v2 protocol, which removes the channel and connection handshakes, narrows the application interface, and opens IBC to domains such as Ethereum while staying compatible with existing channels. Audited at 79218a53, final commit d316a8b6. The same report is published in both repositories, so you may also see it as 2025-04-03-sherlock.pdf in ibc-contracts.

​
Go implementation

Audits of ibc-go, the Go implementation used by Cosmos SDK chains. The GMP review covers the ICS-27 GMP module — keeper, message and query servers, packet relay, derived accounts — together with the attestation light client, at commit 9ffc7482. The ICS-20 v2 review covers multi-denomination support, the memo field, forwarding middleware, and path unwinding. The channel upgrades review covers upgrade handshakes, timeouts, state machine verification, and cancellation. The second 08-wasm entry is a technical review of the client’s architecture rather than a firm’s audit report.

​
Solidity and Ethereum light client

Audits of the Solidity contracts and the Ethereum light client in ibc-contracts. The 2026 review covers ICS27GMP.sol, ICS26Router.sol, ICS20Transfer.sol, the Interchain Fungible Token base and ownership contracts, the ICS-27 account and callback libraries, and the attestation light client, at commit 9798e644. The 2025 review covers the Solidity contracts, the Ethereum light client and trie database, the SP1 ICS-07 Tendermint prover, the cw-ics08-wasm-eth CosmWasm client, and the SP1 programs, at commit 6bb8fcf6. It also reviewed the EurekaHandler contract in skip-mev/skip-go-evm-contracts.

​
Solana implementation

Audits of the Solana programs in ibc-contracts. Covers the ICS-26 router, the ICS-27 GMP application, the Interchain Fungible Token program, the attestation light client, the access manager, and the Solana Tendermint light client, at commit 5560586d. The engagement included a mitigation review of the fixes, at commit 3b594aab.

​
Reporting a vulnerability

Report privately through the security policy for the affected repository, not as a public issue: Paid disclosures go through the Bug bounty on Immunefi.