Liquidium reports 24 of 25 findings resolved after Trail of Bits security review

Liquidium says it has resolved 24 of the 25 findings identified in an independent security review of the Internet Computer Protocol (ICP) canisters supporting its cross-chain lending infrastructure, with the remaining item classified as informational.

The review by blockchain security firm Trail of Bits examined the canister systems behind Liquidium’s loan logic, asset interactions and protocol behaviour across networks. The infrastructure supports cross-chain borrowing, including loans backed by native Bitcoin.

According to Liquidium, the review identified 25 findings across its ICP canister codebase. The company says it assessed each finding, implemented fixes and submitted updates for verification. It has not detailed the individual findings in the supplied announcement, so the nature and severity of the original issues cannot be assessed from that statement alone.

The review report is publicly available through Trail of Bits’ published security reviews.

Liquidium says its cross-chain lending product allows users to provide collateral such as native Bitcoin and borrow assets on other blockchain networks without relying on third-party bridges or centralised wrapped tokens. The company attributes this functionality to the Internet Computer’s Chain Fusion technology, which enables canisters to interact with other blockchain networks.

The announcement follows disclosures relating to PHP2Shell, after which Liquidium says it applied security patches. The company says it runs automated security checks daily and combines them with reviews by human reviewers.

Its stated security process includes recurring scans of critical repositories and dependencies using models and tools from OpenAI, Anthropic and Moonshot AI, as well as CodeRabbit and Codex-based reviews. Liquidium also says it uses Dependabot to monitor dependencies for known vulnerabilities and tests changes in a pre-production environment before deployment.

The company says every pull request undergoes multiple model reviews and mandatory human review. It also states that production changes require multiple signatures from different parties, preventing a single person from independently deploying a canister or smart contract update.

Liquidium says its core code is kept closed source, while an external partner firm reviews changes to its canister and smart contract code. The announcement does not identify that partner or provide further details about the scope and frequency of its reviews.

The company acknowledges that an independent audit reflects the code examined at a particular point in time and cannot guarantee that a system will remain free of vulnerabilities as it changes. Its ongoing review and testing measures are intended to address risks introduced by subsequent updates.

The reported remediation offers users information about Liquidium’s response to the review, although the overall security of a cross-chain lending product also depends on its continuing operation, implementation and handling of assets across networks. Users should review the published report and consider the risks associated with lending and borrowing digital assets before using the platform.