Base Solana (SOL) security report
Base Solana (SOL) on Base security review: bridged CrossChainERC20 at 0x311935Cd80B76769bF2ecC9D8Ab7635b2139cf82, upgradeable beacon proxy, 2 Medium centralization findings, no Critical or High issues.
No Critical or High issues were found in the SOL token on Base, but holders rely on the Base-Solana bridge. The token can be upgraded by the beacon owner, and its supply depends on bridge validators; both are Medium centralization risks.
Trust score: 79/100. Source verified: Yes. Chain: base. Contract: 0x311935cd80b76769bf2ecc9d8ab7635b2139cf82.
This report was last modified on 2026-10-20 and contains 2 material findings.
medium finding: Beacon owner can replace the token logic
The token is an ERC-1967 beacon proxy that reads its implementation from an UpgradeableBeacon. The beacon owner can call upgradeTo to point every CrossChainERC20 token, including this SOL token, at new logic in one transaction. New logic could change balances, transfer rules or mint authority for all holders. The code has no timelock or delay, and the mainnet beacon owner (multisig or EOA) was not verified on-chain in this review.
Evidence: [E08] https://github.com/base/bridge/blob/2bbfe1f67dbae98c5072ab97bb52ba15dd9e2e33/base/src/CrossChainERC20Factory.sol#L91-L105: CrossChainERC20Factory._deploy: creates the token with LibClone.deployDeterministicERC1967BeaconProxy(BEACON, salt) and initializes it; deploySolWrapper deploys the native SOL token ('Solana', 'SOL', 9 decimals) (L66-L68). Commit 2bbfe1f; NOT hash-matched to the BaseScan-verified source because BaseScan/Etherscan was unreachable from the drafting environment. [E09] https://github.com/base/bridge/blob/2bbfe1f67dbae98c5072ab97bb52ba15dd9e2e33/base/script/Deploy.s.sol#L73-L74: Deploy script creates the CrossChainERC20 UpgradeableBeacon with initialOwner = cfg.initialOwner; UpgradeScript.s.sol L97-L105 upgrades all CrossChainERC20 tokens by calling beacon.upgradeTo. Commit 2bbfe1f.
Recommendation: Holders should treat the beacon owner as fully trusted. Base should publish the beacon owner's custody (multisig threshold) and an upgrade notice policy. Radar reviewer: read the beacon address (CrossChainERC20Factory.BEACON) and its owner() on Base before approval.
medium finding: Bridge-controlled minting with no on-chain backing check
Only the Bridge can mint, but it mints whenever a Solana-origin message passes BridgeValidator signature checks (Base validator threshold plus partner validator threshold). There is no supply cap and Base cannot see the locked SOL on Solana, so compromised validator keys, a faulty relayed message or a malicious Bridge upgrade could mint SOL on Base that is not backed. This is the normal trust model for a lock-and-mint bridge.
Evidence: [E07] https://github.com/base/bridge/blob/2bbfe1f67dbae98c5072ab97bb52ba15dd9e2e33/base/src/CrossChainERC20.sol#L71-L167: CrossChainERC20: immutable _BRIDGE, onlyBridge modifier (L71-L74), initialize with initializer (L96-L106), mint and burn restricted to the Bridge (L149-L167); transfers inherited unchanged from Solady ERC20. Commit 2bbfe1f; NOT hash-matched to the BaseScan-verified source because BaseScan/Etherscan was unreachable from the drafting environment. [E10] https://github.com/base/bridge/blob/2bbfe1f67dbae98c5072ab97bb52ba15dd9e2e33/base/src/BridgeValidator.sol#L172-L235: BridgeValidator.registerMessages and _validateSigs: incoming messages must meet the Base validator signature threshold and the partner validator threshold before the Bridge relays them. Commit 2bbfe1f; NOT hash-matched to the BaseScan-verified source because BaseScan/Etherscan was unreachable from the drafting environment. [E12] https://github.com/base/bridge/blob/2bbfe1f67dbae98c5072ab97bb52ba15dd9e2e33/base/src/libraries/TokenLib.sol#L126-L245: TokenLib.initializeTransfer burns CrossChainERC20 from msg.sender when bridging out (L168); finalizeTransfer mints to the recipient when a Solana message is finalized (L245). Commit 2bbfe1f.
Recommendation: Accept as the bridge trust assumption. Base should publish the mainnet validator set and thresholds. Integrators should treat SOL on Base as carrying Base-Solana bridge risk, not Solana native-asset risk.