iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The available audit record for Portal to Bitcoin reports 15 smart-contract issues, including one critical and one high-severity finding. Its whitepaper says the critical issue was fixed in a subsequent commit and the high-severity refund-timelock issue was only partially resolved. Those are historical audit disclosures—not confirmation of the code currently deployed. To assess present risk, first identify which Portal project and deployment you mean, then match its live contracts to the audited code and fixes.
Which Portal does this analysis cover?
“Portal” is not a unique project name. This article covers Portal to Bitcoin, whose crypto-asset whitepaper describes a Cosmos-based zone for atomic cross-chain asset swaps. It is not an analysis of Ethereum’s separate Portal Network, a peer-to-peer protocol effort for lightweight access to Ethereum data and JSON-RPC functionality. The Ethereum Portal Network specifications describe access to account and state data, including contract code and storage, with validation against a recent header; they do not establish facts about Portal to Bitcoin’s bridge contracts.
The distinction matters because a project name alone cannot identify the contracts, chains, assets, or control structure exposed to risk. The whitepaper’s architecture is the source for the Portal-to-Bitcoin system described below; it is not independent confirmation that every part of that architecture remains current.
What did the reported audit find?
Portal to Bitcoin’s whitepaper says Grey Swan audited core Portal Network smart contracts on Portal and Ethereum from June 23 through July 21, 2025, against code at commit 816e32a. The whitepaper reports 15 issues and 12 considerations: one critical, one high, three medium, and ten low issues. It says Grey Swan recommended resolving critical and high issues before deployment and also resolving medium and low issues.
#1 Best Overall
- Designed by Valve staff, the makers of Portal & Portal 2!
- Includes a free Steam code for a copy of Portal 2!
- Fast and fun gameplay
- Modular board
- Includes miniatures of popular Portal game elements
The following dispositions are the whitepaper’s account of the audit, not a fresh assessment of current contracts:
| Severity | Reported finding | Disposition stated in the whitepaper |
|---|---|---|
| Critical | In CustomERC6909, setOperator and approve reportedly allowed any user to grant themselves unlimited permission to transfer assets from another user’s account, creating a direct theft risk. |
The Portal team reportedly fixed it in a subsequent commit. The whitepaper does not establish that the fix is present in every live deployment. |
| High | The HTLC-based Invoice Manager reportedly had no refund timelock for the first depositor. If the second swap party did not complete, the first party’s assets could remain locked indefinitely. | Marked “Partially Resolved”: a timelock was added, while dynamic adjustment based on network conditions was still in progress. |
| Medium | The Asset Manager reportedly did not check whether a chain was enabled before registering an asset. | The whitepaper says this was fixed. |
| Medium | A receive function in two contracts reportedly could accept Ether without crediting the sender, potentially causing a loss. |
The whitepaper says this was fixed. |
| Medium | An unchecked power-accumulator calculation in the Portal Gateway reportedly could allow a small validator group to manipulate the validator set through integer overflow. | The whitepaper says this was fixed. |
| Low | Ten low-severity issues and 12 considerations were reported overall; the whitepaper characterizes them primarily as code-quality, best-practice, and edge-case concerns. | The available summary does not provide further particulars for these items. |
How the described design shapes the risk
The whitepaper describes users bridging assets into a margin account, then using an order book to swap with counterparties while minimizing required collateral. It identifies a centralized Validator, initially the Portal team, and the Portal Foundation as key actors in managing the swap workflow, registering assets, and controlling bridge-fund release. These are the whitepaper’s descriptions, not independently verified statements about current control arrangements.
Rank #2
- ADVENTURE-PACKED GAMEPLAY: Dive into the fiery underworld of Minecraft's Nether, sprint through rugged landscapes, and battle dangerous monsters - all in a bid to escape and survive together
- IDEAL GIFT: Perfect for the gamer or Minecraft fan in your life - suitable for both boys and girls, teens and adults alike
- USER-FRIENDLY: Comes with high-quality, easy-to-understand instructions for quick learning. Includes rules for faster games or sessions with young children
- QUALITY YOU CAN TRUST: Proudly brought to you by Ravensburger - one of the largest board game manufacturers globally, with millions of games sold worldwide
- ENCOURAGES STRATEGIC THINKING: As the game progresses, players collect increasingly powerful equipment, strategize their moves, and prepare for the arduous adventure ahead
That design makes security more than a question of whether an individual function has a bug. A reviewer needs to understand who can move or release assets, how both sides of a swap complete or recover funds, how validator decisions are authorized, and what happens when a chain is delayed or unavailable. Bridges also carry design-dependent smart-contract, wrapped-asset, counterparty, and operational risks. Ethereum.org cautions: “While many bridges have successfully passed audits, all it takes is one flaw in a smart contract for assets to be exposed to hacks.” This is a general warning about bridges, not a finding about Portal to Bitcoin.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat to check in a deployment-specific review
Before judging exploitability, map the actual deployed assets, contracts, chains, trust boundaries, and privileged actors. The audit findings point to several concrete review areas:
Rank #3
- EMBARK ON EPIC ADVENTURES: Compete for the coveted Crown of Command in a magical realm! This Talisman: The Magical Quest Game, 5th Edition offers a thrilling experience, combining strategy and luck
- UPDATED GRAPHICS, COMPONENTS, AND GAMEPLAY: This 5th edition features stunning artwork, redesigned figures, and more streamlined and accessible gameplay that lets both newcomers and fans jump into a game
- 12 DETAILED CHARACTER FIGURES: Play as one of 12 powerful characters, including a Prophetess, Wizard, and Thief. Includes 12 Character figures and matching cards that reveal a character’s unique ability
- FIND THE TALISMAN: Set forth on a dangerous journey—race to be the first to acquire a Talisman, reach the Crown of Command, and vanquish its guardian dragon to win
- TRAVEL THROUGH A MAGICAL LAND: The generously sized board depicts the land of Talisman, 3 regions of enchanted locations. The board changes as players layer on Adventure cards with more places to encounter
Authorization and asset movement
- Trace every operator, approval, mint, burn, escrow, release, and emergency path.
- Verify that each permission check binds the intended owner, asset, and action; test whether one account can exercise authority over another account’s holdings.
Swap completion, refunds, and timeouts
- Follow both parties’ deposit, completion, and refund paths, including what happens when one party stops responding.
- Compare timeout assumptions across participating chains and test congestion, delayed finality, and other conditions that could make a refund arrive too late or fail.
Chain and asset registration
- Confirm that a chain must be enabled before its assets or routes can be registered.
- Check that changes to registration cannot create unsupported or unbacked asset claims.
Value accounting and native-asset receipt
- Verify that every accepted transfer updates the correct user or account balance, including native-asset receipt and fallback paths.
- Inspect failed external calls and confirm that they cannot leave value accepted without corresponding accounting.
Validator power and set transitions
- Review arithmetic bounds, validator membership changes, signature and quorum rules, and whether a low-power group can influence a set transition.
- Test accumulator calculations at boundary values rather than relying only on ordinary validator weights.
Bridge permissions and trust assumptions
- Identify who verifies cross-chain transfers and who can halt, censor, or release funds.
- If cross-chain mint/burn interfaces are used, inspect which contracts are authorized to call them and whether suitable limits exist. ERC-7802 describes a token standard proposal in which issuers control authorized cross-chain mint/burn callers; it warns that a buggy or malicious authorized caller may harm holders. This proposal is a review reference, not evidence that Portal implements it.
How to tell whether the audit applies to live contracts
An audit applies to the reviewed code and scope, not automatically to later commits, every chain deployment, or a proxy’s current implementation. To establish whether the 2025 findings or their reported fixes apply, gather the following evidence for each deployment:
- Record the chain ID and contract address, along with verified source or a reproducible build for the deployed bytecode.
- For upgradeable contracts, identify the proxy, implementation, admin, and current role holders; inspect the upgrade history.
- Compare the deployed code with audited commit
816e32aand with the specific subsequent commits claimed to remediate findings. - Confirm the refund-timelock behavior in the deployed Invoice Manager, including whether its duration can adapt to network conditions.
- Recheck privileged permissions and configuration on-chain, since a code match alone does not establish who currently controls operational functions.
If that evidence is unavailable, the accurate conclusion is that the audit’s reported findings and statuses are known historically, while the current deployment’s matching code and remediation status are unverified. The whitepaper does not, by itself, establish current live code, a present contract inventory, or whether any issue remains exploitable.
Rank #4
- Timeless Gameplay: Experience the iconic Othello strategy game loved for generations, where every move can flip the board in your favor.
- Easy to Learn, Hard to Master: Simple rules make it accessible to beginners, while deep strategy keeps even experienced players challenged.
- Head-to-Head Competition: Designed specifically for two players, Othello offers quick, competitive matches that are never the same twice.
- Portable and Practical: Designed with a compact board and convenient slide‑out storage drawers on each player’s side, making setup, cleanup, and on‑the‑go play fast and effortless. Perfect for travel, family game nights, and organized storage.
- Family-Friendly Fun: Ideal for ages 8 and up, Othello encourages critical thinking, planning ahead, and friendly competition at home or on the go.
Bottom line
The Portal-to-Bitcoin whitepaper records a significant historical audit, including a critical authorization flaw and a high-severity refund-locking issue. It also reports fixes or partial resolution for several findings, but those statements are not proof of deployed remediation. A useful present-day risk assessment must first identify the exact Portal deployment and then verify its bytecode, upgrade state, permissions, and refund behavior against the audited version and subsequent fixes.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
