Liquidium has completed an independent security review of the ICP canisters supporting its cross-chain lending infrastructure, with the assessment identifying 25 findings across the codebase.
The review was carried out by blockchain security firm Trail of Bits and covered the canister systems responsible for loan logic, asset interactions and protocol behaviour across networks. The infrastructure is used for Liquidium’s cross-chain lending products, including loans backed by native Bitcoin.
According to Liquidium, 24 of the 25 findings identified during the review have since been resolved, while the remaining finding has been classified as informational. The company said it reviewed the findings, implemented fixes and submitted the changes for verification.
Trail of Bits describes its blockchain security assessments as reviews designed to identify vulnerabilities and architectural risks, with remediation work followed by fix reviews in relevant engagements.
For Liquidium, the review focuses attention on the security of the ICP canisters that underpin its cross-chain lending infrastructure. The company says its system allows users to use collateral such as native Bitcoin while borrowing assets on other blockchain networks without relying on third-party bridges or centralised wrapped versions of Bitcoin.
The infrastructure uses the Internet Computer Protocol’s Chain Fusion technology to interact with other blockchain networks. Liquidium says this allows its canisters to handle cross-chain activity directly.
The company said the review was conducted as part of its efforts to address implementation risks before expanding its lending infrastructure to additional assets and chains. The 24 resolved findings are presented as evidence of remediation work following the assessment, although a security review represents an assessment of the system at a particular point in its development rather than a permanent guarantee of security.
Liquidium has also outlined additional security measures covering its development and production processes. These include recurring security scans, automated code review tools, dependency monitoring and human review of pull requests.
The company said its core code remains closed source and that an external partner reviews changes to its canister and smart contract code. It also said production changes require multiple signatures from different parties, meaning a single person cannot independently deploy a canister or smart contract update.
Security remains a continuing concern across decentralised finance, where lending protocols can face risks from smart contract vulnerabilities, compromised dependencies and operational weaknesses. Trail of Bits has previously highlighted the need for security measures that go beyond individual code audits, including stronger operational controls and ongoing review.
Liquidium said it will continue using automated tools, external reviews and internal testing as its products develop.
The full Trail of Bits assessment is publicly available through its GitHub publications repository.
Dear Reader,
Ledger Life is an independent platform dedicated to covering the Internet Computer (ICP) ecosystem and beyond. We focus on real stories, builder updates, project launches, and the quiet innovations that often get missed.
We’re not backed by sponsors. We rely on readers like you.
If you find value in what we publish—whether it’s deep dives into dApps, explainers on decentralised tech, or just keeping track of what’s moving in Web3—please consider making a donation. It helps us cover costs, stay consistent, and remain truly independent.
Your support goes a long way.
🧠 ICP Principal: ins6i-d53ug-zxmgh-qvum3-r3pvl-ufcvu-bdyon-ovzdy-d26k3-lgq2v-3qe
🧾 ICP Address: f8deb966878f8b83204b251d5d799e0345ea72b8e62e8cf9da8d8830e1b3b05f
Every contribution helps keep the lights on, the stories flowing, and the crypto clutter out.
Thank you for reading, sharing, and being part of this experiment in decentralised media.
—Team Ledger Life
Community Discussion