ckBTC Integration

Warn

Audited by Socket on Feb 27, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

The codebase represents a legitimate ckBTC integration pattern with clear, IC-native canister interactions between a ledger and a minter. There are no evident malicious behaviors, credential exfiltration, or external data sinks. The primary risks are operational: correct subaccount derivation, correct handling of the 10 satoshi fee, and ensuring the minter/ledger responses are properly checked to avoid misbehavior or race-condition issues. Given the explicit use of mainnet canister IDs and cross-canister calls, the footprint aligns with the stated purpose of ckBTC integration, not a covert supply-chain attack. Treat as benign with medium operational risk due to integration complexity and potential minter behavior changes.

Confidence: 75%Severity: 75%
Audit Metadata
Analyzed At
Feb 27, 2026, 02:39 AM
Package URL
pkg:socket/skills-sh/dfinity%2Ficskills%2Fckbtc-integration%2F@546d2cb77651638eb74b6d93c495043e4920a42a