EVM Audit by Consensys Diligence
Consensys Diligence reviewed the smart contracts behind Coinbax escrow in July 2026. They found no critical or high severity issues, and every finding they raised has been fixed.
What was reviewed
The review covered the EVM escrow contracts, WorkspaceEscrow.sol andEscrowFactory.sol, together with their interfaces. The Solana escrow program, the mock token contracts, the test suite, and the deployment scripts were outside the scope of this engagement.
- Auditor
- Consensys Diligence
- Review window
- July 7 to July 15, 2026
- Scope
- EVM escrow contracts and interfaces
- Target chain
- Base
Coinbax does not control funds in transit
This is the property that matters most to a risk team, and it was verified independently rather than asserted by us. The auditors reviewed the separation between the factory contract that Coinbax administers and the individual escrow contracts that hold funds, and confirmed that the flow of funds is controlled exclusively by the privileged actors defined in each escrow and its configuration.
Two consequences are worth stating plainly. A compromised administrator cannot reach an escrow that already exists: it cannot move, redirect, or freeze funds already held. And no role, not even the administrator, can seize escrowed funds. That is deliberate, and the trade-off is real: funds that become genuinely stuck cannot be rescued by us either. The report documents the bounded case, where a sender can always reclaim everything 30 days after the release time.
Findings
Consensys Diligence rates critical and major issues as security vulnerabilities, medium issues as objective but not vulnerabilities, and minor issues as subjective suggestions around best practice and readability. Nothing in this review reached medium or above.
| Finding | Severity | Status |
|---|---|---|
| Inaccurate documentation comment for deregisterWorkspace | Minor | Fixed (PR-120) |
| An escrow could look gated but enforce no release gate | Minor | Fixed (PR-121) |
| Factory constructor did not require the admin and mirror signer to differ | Minor | Fixed (PR-121) |
| No way for Coinbax to pause deposits into an existing escrow | Minor | Fixed (PR-118) |
| Payout recovery consistency and improvements | Minor | Fixed (PR-116) |
| Escrows could deploy for fee-unconfigured workspaces, contradicting the docs | Minor | Fixed (PR-111) |
| Misleading dedicatedEscrow pointer | Unrated | Fixed (PR-119) |
| Structs and events could be isolated to an interface file | Unrated | Acknowledged |
Finding 5.8 was acknowledged and deliberately not pursued, as it carries no security impact. It proposes moving structs and events into a separate interface file.
What this audit does not yet cover
We would rather state the gap than let you discover it. Since this review closed, a relayer authorization function has been added to the escrow contract, allowing an authorized relayer to create an escrow while the user remains the owner. That change falls outside the audited scope, so the report describes the contracts as they stood in July 2026 rather than the current state.
A follow-up review covering that function is being scoped with Consensys Diligence. This page will be updated when it completes. If you are evaluating Coinbax and this delta matters to your assessment, talk to us and we will walk you through the change directly.
Request the full report
The complete report includes the system overview, the security specification with its actors and trust model, the fund-flow analysis, and every finding in full technical detail. Tell us where to send it.
Consensys Diligence publishes its reports with client consent. As the report itself states, it is not an endorsement of this project or team, and it is not a guarantee as to the absolute security of the project. Its contents are current as of the date appearing on the report. A security review reduces risk; it does not eliminate it.