Liquidium says it has resolved 24 of the 25 findings identified in an independent security review of the Internet Computer Protocol (ICP) canisters supporting its cross-chain lending infrastructure, with the remaining item classified as informational.
The review by blockchain security firm Trail of Bits examined the canister systems behind Liquidium’s loan logic, asset interactions and protocol behaviour across networks. The infrastructure supports cross-chain borrowing, including loans backed by native Bitcoin.
According to Liquidium, the review identified 25 findings across its ICP canister codebase. The company says it assessed each finding, implemented fixes and submitted updates for verification. It has not detailed the individual findings in the supplied announcement, so the nature and severity of the original issues cannot be assessed from that statement alone.
The review report is publicly available through Trail of Bits’ published security reviews.
Liquidium says its cross-chain lending product allows users to provide collateral such as native Bitcoin and borrow assets on other blockchain networks without relying on third-party bridges or centralised wrapped tokens. The company attributes this functionality to the Internet Computer’s Chain Fusion technology, which enables canisters to interact with other blockchain networks.
The announcement follows disclosures relating to PHP2Shell, after which Liquidium says it applied security patches. The company says it runs automated security checks daily and combines them with reviews by human reviewers.
Its stated security process includes recurring scans of critical repositories and dependencies using models and tools from OpenAI, Anthropic and Moonshot AI, as well as CodeRabbit and Codex-based reviews. Liquidium also says it uses Dependabot to monitor dependencies for known vulnerabilities and tests changes in a pre-production environment before deployment.
The company says every pull request undergoes multiple model reviews and mandatory human review. It also states that production changes require multiple signatures from different parties, preventing a single person from independently deploying a canister or smart contract update.
Liquidium says its core code is kept closed source, while an external partner firm reviews changes to its canister and smart contract code. The announcement does not identify that partner or provide further details about the scope and frequency of its reviews.
The company acknowledges that an independent audit reflects the code examined at a particular point in time and cannot guarantee that a system will remain free of vulnerabilities as it changes. Its ongoing review and testing measures are intended to address risks introduced by subsequent updates.
The reported remediation offers users information about Liquidium’s response to the review, although the overall security of a cross-chain lending product also depends on its continuing operation, implementation and handling of assets across networks. Users should review the published report and consider the risks associated with lending and borrowing digital assets before using the platform.
Dear Reader,
Ledger Life is an independent platform dedicated to covering the Internet Computer (ICP) ecosystem and beyond. We focus on real stories, builder updates, project launches, and the quiet innovations that often get missed.
We’re not backed by sponsors. We rely on readers like you.
If you find value in what we publish—whether it’s deep dives into dApps, explainers on decentralised tech, or just keeping track of what’s moving in Web3—please consider making a donation. It helps us cover costs, stay consistent, and remain truly independent.
Your support goes a long way.
🧠 ICP Principal: ins6i-d53ug-zxmgh-qvum3-r3pvl-ufcvu-bdyon-ovzdy-d26k3-lgq2v-3qe
🧾 ICP Address: f8deb966878f8b83204b251d5d799e0345ea72b8e62e8cf9da8d8830e1b3b05f
Every contribution helps keep the lights on, the stories flowing, and the crypto clutter out.
Thank you for reading, sharing, and being part of this experiment in decentralised media.
—Team Ledger Life
Community Discussion