Arbitrum One holds billions of dollars across bridged tokens, stablecoins and yield vaults. We wanted to know how the contracts behind eight widely used assets actually behave, so we reviewed WBTC, LINK, VISR, cbBTC, USDS, sUSDS, sUSDC and RAIN.

How we reviewed them

For each contract we matched the deployed bytecode to its public source, recompiled it with the exact compiler version Arbiscan reports, ran Slither and Solhint, and, where possible, deployed the real compiled bytecode to a local EVM and tested it live. Where we could not verify something on-chain, the report says so.

The headline

No Critical or High severity findings in any of the eight contracts. But a clean code review is not the same as low risk. The bigger difference between these assets is their trust model: who is able to change the token's behaviour after you hold it.

Bridge tokens: minimal trust, shared code (WBTC, LINK, VISR)

These use Arbitrum's standard bridge token logic. There is no owner, admin, pauser or blacklister. The only privileged caller is the L2 gateway, set once at deployment. WBTC and LINK run byte-for-byte identical implementations, which we confirmed by comparing addresses rather than trusting Arbiscan's label. For VISR, Arbiscan did not show a resolved implementation address, so our match rests on strong circumstantial evidence and is flagged as an assumption.

The trade-off: because the code is shared, a defect in it would affect every token cloned from it.

Stablecoins and vaults: where the trust decisions live

cbBTC reuses Circle's own USDC codebase (FiatTokenV2_1). The code is very clean and all 27 of our live tests passed, but it carries the largest control surface in the set: an owner, per-address minters, a pauser, a blacklister and a separate proxy admin.

USDS and sUSDS come from Sky Ecosystem's MakerDAO lineage and use the wards/auth governance pattern. Minting is governed, while burn() is open by design, matching DAI. No exploitable bugs were found, so the practical question is who currently holds ward status. sUSDS's repository also already carries two professional audits (Cantina and ChainSecurity).

sUSDC (Spark's USDC vault) is the most mechanically complex contract. It had three Medium findings in its own code: a divide-before-multiply precision loss in a view function, a loosely typed token interface and an ignored return value. None were exploitable in our live tests. Its safety also depends on an external PSM contract that was outside our scope.

The smaller project: RAIN

RAIN has no public source repository, so we recovered the source from Arbiscan. Its code compiled and passed all 21 tests. We flagged unused legacy price-feed code left over from an earlier version, and the fact that upgrades are now permanently disabled, which reduces owner control but also means a future bug could not be patched through the same proxy.

What to take away

• "No critical or high findings" describes the code, not the trust model.

• Before relying on any of these assets, check on-chain who holds the privileged roles today.

• Shared implementations are efficient but concentrate risk.

Read the full reports

1. cbBTC: https://docs.google.com/document/d/1SFfej2Navh83j2iS8ilRnCIUVTfbI5J_/edit?usp=sharing&ouid=100643542964034034914&rtpof=true&sd=true

2. LINK: https://docs.google.com/document/d/1XI4nl0FhGoejdk2wzAy9hxG3IJqnQK0j/edit?usp=sharing&ouid=100643542964034034914&rtpof=true&sd=true

3. RAIN: https://docs.google.com/document/d/1xSOpCiK8kBhHrqmE8XSDlVQk2Km4O10W/edit?usp=sharing&ouid=100643542964034034914&rtpof=true&sd=true

4. sUSDC: https://docs.google.com/document/d/1AN2ASRObdtRb0BtUc187YsketqnhDTm0/edit?usp=sharing&ouid=100643542964034034914&rtpof=true&sd=true

5. sUSDS: https://docs.google.com/document/d/1PJLVyAW64hIglgzU3ynSX029XG86uCZb/edit?usp=sharing&ouid=100643542964034034914&rtpof=true&sd=true

6. USDS: https://docs.google.com/document/d/1PdmCNCpaVo7-oLJGAYNVPjAvzLCn5tu3/edit?usp=sharing&ouid=100643542964034034914&rtpof=true&sd=true

7. VISR: https://docs.google.com/document/d/1lxxC6qdy1N\_z6xutYPRnpMY6swlhsmiK/edit?usp=sharing&ouid=100643542964034034914&rtpof=true&sd=true

8. WBTC: https://docs.google.com/document/d/1DsGFYn8CPqDCxVJwUe28zAOAYi7xqbgr/edit?usp=sharing&ouid=100643542964034034914&rtpof=true&sd=true

This post summarizes independent reviews prepared by an EtherAuthority intern. They are not endorsements or guarantees of security, and should not be presented as official audits.