Summary
Security assessment of SodaX's Clarity spoke contracts, focusing on the protocol's cross-chain execution logic and liquidity coordination mechanisms within the Stacks environment.
This engagement was performed through Sherlock, under its collaborative audit framework. Cyba Security's work on the platform is available on our Sherlock Watson profile.
Audited Functionality
SodaX is a cross-chain liquidity layer that provides intent-based execution infrastructure across multiple blockchains. It is built around a hub-and-spoke architecture, where a central hub chain coordinates liquidity and execution, while spoke contracts deployed on connected chains handle local asset management and cross-chain message passing.
The audited scope covers the Clarity Spoke which is the Stacks-side implementation of SodaX's cross-chain protocol, written in Clarity.
Three core components of the Clarity spoke were reviewed:
- Asset Manager: responsible for value transfer between the Stacks chain and the SodaX hub (Sonic chain). It handles deposits, withdrawals and acts on behalf of callers using bridged tokens to support multi-step cross-chain interactions.
- Rate Limiter: enforces transfer volume constraints over rolling time windows, bounding the protocol's exposure in systemic risk of black swan type events.
- Connections Contract: acts as the cross-chain messaging gateway. It verifies incoming messages from the relayer layer and routes outgoing messages to other connected chains, forming the communication backbone of the spoke.
Together, these components implement the full cross-chain execution and communication logic of the Stacks spoke within the broader SodaX protocol.
Findings Breakdown
About SodaX
sodax.comSodaX is a cross-chain liquidity layer platform that provides intent-based execution infrastructure for decentralized finance applications. The protocol leverages native liquidity on Sonic to facilitate swaps, lending, and cross-chain interactions. SodaX is designed as an execution coordination layer, enabling applications to integrate through a unified SDK while maintaining control over pricing logic, user experience, and risk configuration. The protocol manages how transactions are executed across varying network conditions, with a focus on predictable execution outcomes across multiple chains.
About Sherlock
sherlock.xyzSherlock is a Web3 security organization that provides lifecycle security services for onchain protocols. Its model covers multiple stages of a protocol's development, including pre-launch review, competitive auditing, and post-deployment security monitoring. Sherlock operates at the intersection of security review and economic alignment, focusing on systems where smart contracts directly manage user capital. The organization structures engagements to address risks that may arise from evolving protocol logic, integrations, and incentive mechanisms over time. Sherlock frequently coordinates audits through a distributed network of independent security researchers and firms.
Details
- Date
- Feb 2026
- Client
- SodaX
- Via
- Sherlock
- Disclosure
- Public
- Blockchain
Stacks- Auditors
- ABASilverologist
- Categories
- ClarityCross-ChainDeFi