Firepan · Audit Report · FP-AUDT-2026-0003
Independent review of the VIA Labs EVM v1 cross-chain messaging stack
A pre/post-deployment review of VIA Labs' ViaGatewayV1 / ViaIntegrationV1 / FeeCollector family on the EVM_v1 branch of DruuuCLT/viagateway-v1, conducted by Firepan in February–March 2026. Seventeen items were surfaced and walked end-to-end with VIA Labs' engineering team through a color-coded per-item rationale exchange. Two were confirmed as auth-bypass primitives in _validateMessage — both with VIA Labs-authored inline fixes proposed at the same review pass.
Engagement summary
- 17 items walked with VIA Labs engineering
- 2 confirmed High-severity findings (auth-bypass primitives)
- 2 inline fixes proposed by VIA Labs, reviewed and confirmed correct by Firepan
- 1 Firepan self-downgrade (Item #9, tx.origin usage, downgraded to Informational after VIA Labs surfaced existing access controls)
- 7 items investigated and cleared as by-design
Confirmed findings
| ID | Severity | Component | Finding |
|---|---|---|---|
| F-10 | High | ViaGatewayV1.sol:L656 | _validateMessage does not enforce the scope of project-layer signers during signature validation — a project-layer signer registered for one project can satisfy the project-signature requirement for a message routed to an unrelated project. VIA Labs proposed an inline fix at the same location; Firepan confirmed the patch is correct. |
| F-11 | High | ViaGatewayV1.sol:L649 | Validation does not check the isEnabled state of signers — disabled signers retain validation authority until structurally removed from the signer set, so revoking a compromised or stale signer does not actually revoke their ability to authorize cross-chain messages. VIA Labs proposed an inline fix at the same location; Firepan confirmed the patch is correct. |
Investigated and cleared (by design)
Seven items were walked end-to-end with VIA Labs' architectural rationale and confirmed by-design: processed-flag write ordering (IC-1, IC-8), max-uint allowances to immutable fee/gas collectors gated by an onlyProjectOwner cap (IC-2, IC-3), signature-ordering gas optimization (IC-6), trust-based gas refunds absent a project maxGas cap (IC-12), and single-owner control over protocol configuration with a documented multisig migration path (IC-16). Full rationale for each is in the interactive report below.
Run a free surface scan on your own contracts →
Read the companion case study at firepan.com/case-studies/vialabs/.