{
  "id": 16558834,
  "title": "Security Audit Report: Reentrancy & Access Control Review: Bitget",
  "url": "https://urgent.news/2026/10/26/security-audit-report-reentrancy-access-control-review-bitget",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-26T04:17:48.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/dannydoes_2abdf9c/security-audit-report-reentrancy-access-control-review-bitget-28i1"
  },
  "original_language": "en",
  "account": "Bitget's DeFi infrastructure, with a Total Value Locked (TVL) of approximately $6.8 billion, utilizes a proxy-based upgradeability pattern along with off-chain order matching. During a security audit, four critical weaknesses were identified that could allow malicious actors to steal user funds, escalate privileges, bypass rate limits, and manipulate governance parameters.\n\nThe most significant issue is a reentrancy vulnerability in the Vault contract's withdraw() function, which can be exploited by deploying a malicious contract that re-enters the withdraw() function before reducing the user's balance. This can lead to a full drain of user balances, potentially amounting to the entire contract's value. Additionally, there is no ReentrancyGuard or nonReentrant modifier present to mitigate this weakness.\n\nOther identified issues include improper access control on the ProxyAdmin contract's upgrade() function on the Layer 2 (L2) deployment, allowing potential admin takeover through governance exploits. There is also a lack of rate-limit checks on the Router contract's swap() function, enabling repeated re-entrancy calls that could drain liquidity pools. Finally, an uninitialized storage slot in the upgradeable Vault contract allows for privilege escalation and contract pausing if exploited.\n\nOverall, the risk score for the current Bitget deployment is 7.4 out of 10, indicating a high risk level. The audit provides a prioritized remediation plan, which includes implementing ReentrancyGuard across all contracts, enforcing access controls on the ProxyAdmin contract, adding rate-limits to the Router swap() function, and ensuring proper initialization of storage slots during contract upgrades.",
  "summary": "Security Audit Report: Reentrancy & Access Control Review: Bitget Target Protocol : Bitget (TVL: $6818.6M) Security Audit Report Reentrancy & Access‑Control Review – Bitget Date: 26 Oct 2026 Prepared by: [Your Name], Senior DeFi Security Researcher & Smart‑Contract Auditor Scope – This audit focuses on the reentrancy‑related logic and access‑control mechanisms of the Bitget smart‑contract suite…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}