Audit history
Every review the contracts have been through, in order, each linked to its job and its full record. Each round was pinned to one commit; its findings were fixed or answered in the commit after it, and the next round was pinned to that. Read top to bottom, the table is one chain from the first audit to today.
How the reviews are run
The audits are jobs on the IdentityMD network, paid in IMD, and each is public on the IMD explorer. Three kinds appear below:
- Panel (
template: audit): four specialists read the same code at the same commit, one each for arithmetic, permissions, economics and control flow, and a judge merges their findings and re-runs every claim against the tree before it is kept. Most of the history is panels. - Adversarial review (
adversarial-review): one reviewer over the whole of the contracts, looking for what crosses subsystem lines. - Single audit (
audit-imported-code): one auditor over a stated scope, used for the first two rounds.
Four reviews were done in-house rather than by the network; they are marked as such.
Each record keeps the reviewer's or judge's summary verbatim, every finding with its reproduction, the raw submission beside it (with its sha256), and, for the later rounds, a resolution table saying how each finding was answered. A proof that came with a finding is kept as a regression test, so a fixed finding stays fixed.
The chain
Severity counts (C/H/M/L/I) are critical, high, medium, low and info, as the round's judge or auditor kept them. "Answered in" is the commit that fixed, or accepted with a stated reason, every finding of that round.
| # | Date | Review | Kind | Pinned to | C/H/M/L/I | Answered in | Record |
|---|---|---|---|---|---|---|---|
| 1 | 2026-10-03 | The in-house contracts | Single audit, job c71449d1 | the pre-launch tree | 0/1/2/4/4 | 332f023, 0fe0381, 19829a9 | Record |
| 2 | 2026-10-04 | The dollar denomination and work-backing surface | Single audit, job da7d5b1c | 36f305a | 0/0/3/2/0 | 1f15c2a | Record |
| 3 | 2026-10-04 | What is proven, what is argued, what stands before mainnet | In-house | the tree that day | a gap list, not a severity count | 00b60b9 | Record |
| 4 | 2026-10-05 | Launch audit: the vault | Panel, job 414e25cc | e52a025 | 0/0/3/4/9 | 03e8d0c | Record |
| 5 | 2026-10-05 | Launch audit: governance | Panel, job ae08d373 | e52a025 | 0/0/1/3/11 | 03e8d0c | Record |
| 6 | 2026-10-05 | Launch audit: the oracle | Panel, job f6faeaf9 (judge out of budget after one finding; the specialists' others went into the fix plan) | e52a025 | 0/1/0/0/0 | 03e8d0c | Record, fix plan |
| 7 | 2026-10-05 | Launch audit, phase 2: the fixed tree | Adversarial review, job 5e2f7703 | 03e8d0c | 0/0/2/3/1 | 9dd2149 | Record |
| 8 | 2026-10-05 | Gas, without weakening any guard | Research report, job ca1b7686 | 03e8d0c | proposals, each accepted or refused with its reason | 9dd2149 | Record |
| 9 | 2026-10-06 | Every contract, the deploy path and the oracle payloads | In-house | a4c22a5 | 0/1/1/5/a few | ce39fc6 | Record |
| 10 | 2026-10-06 | Final pre-launch review | Adversarial review, job d744e818 (partial: out of turns) | 002605f | 0/1/2/3/0 | cc4103f, reviewed in 8dd0847 | Record |
| 11 | 2026-10-07 | Final pre-launch review, the half the first did not reach | Adversarial review, job cc8d583b | 8dd0847 | 0/0/1/4/2 | b73a05f | Record |
| 12 | 2026-10-07 | Final panels: the vault | Panel, job 6a5f4140 | b73a05f | 0/0/2/3/3 | 8756817 | Record |
| 13 | 2026-10-07 | Final panels: governance and the Treasury | Panel, job e4a6f30e | b73a05f | 0/0/1/2/5 | 8756817 | Record |
| 14 | 2026-10-07 | Final panels: the price path | Panel, job f1346a93 | b73a05f | 0/0/1/3/3 | 8756817 | Record |
| 15 | 2026-10-07 | Sweep panels: the vault | Panel, job 43b96259 | 8756817 | 0/1/4/1/3 | 973369e | Record |
| 16 | 2026-10-07 | Sweep panels: governance and the Treasury | Panel, job f6219aa5 | 8756817 | 0/0/0/2/2 | 973369e | Record |
| 17 | 2026-10-07 | Sweep panels: the price path and the deploy checks | Panel, job ecd0a279 | 8756817 | 0/0/0/4/7 | 973369e | Record |
| 18 | 2026-10-08 | Retry panel: the vault's redesigned lag | Panel, job 3226aaed | 973369e | 0/1/4/2/2 | 24337a2, 58f73de | Record |
| 19 | 2026-10-08 | Retry panel 2: warmth per position | Panel, job a2640621 | 24337a2 | 0/0/3/5/2 | d7fceab | Record |
| 20 | 2026-10-08 | Final vault panel | Panel, job 45bf3777 | d7fceab | 0/1/4/5/3 | 6085c8a | Record |
| 21 | 2026-10-08 | Final sweep: the whole system | Panel, job 08a12413 | 6085c8a | 0/0/0/3/2 | 77d8878 | Record |
| 22 | 2026-10-08 | Delta panel: what the final sweep's fixes changed | Panel, job fc96f209 | 07905bb | 0/0/1/2/4 | 46b646f | Record |
| 23 | 2026-10-08 | Launch vault panel: the vault in full | Panel, job 5383ced0 | 9bd5f59 | 0/1/2/1/1 | d3861ac, by replacing the backing lag with paced figures | Record |
| 24 | 2026-10-08 | Paced vault panel: the redesigned vault in full | Panel, job dc27aade | d3861ac | 0/0/3/2/6 | c1ecb05 | Record |
| 25 | 2026-10-09 | Final sweep 2: the whole system, after the paced figures | Panel, job a69e204e | a3aa9e4 | 0/1/0/2/4 | 92b873b | Record |
| 26 | 2026-10-09 | Payout vault panel: the vault on the sweep's fix (the paced payout price, the clamp, the seed, the price read once, the transient guard) | Panel, job f936eafb | c90e8d9 | 0/1/0/3/1 | 73191e0 | Record |
| 27 | 2026-10-09 | Final sweep 3: the whole system, after the payout price | Panel, job ed4f7f6d | e4baedf | 0/1/0/3/2 | dba2cb3 | Record |
| 28 | 2026-10-09 | Final sweep 4: the whole protocol, every mechanism, after the premise was corrected | Panel, job 6229d0fc | c7d50ee | 0/0/1/2/4 | df82607 | Record |
| 29 | 2026-10-10 | The work-root fix: the work oracle keeps no epoch, so a missed day no longer stops it accepting roots | In-house | 549dfdd | no findings; one comment corrected | c1381eb | Record |
| 30 | 2026-10-10 | Intake v2 and the oracle purchases' failure callback | In-house | 79d0b82 | no findings | 79d0b82 | Record |
What the chain shows
- No critical finding in any round. The highs were five: three in the vault's backing lag, each fixed in the commit after it, then two in the oracle's reach over redemption payouts, which a pool held down through the feed's window could inflate: round 25 found the route and the price a redemption is paid at was paced; round 26 showed the first rate (5% an hour) only delayed the hold by five hours, and the rate is now 1% an hour, so a profitable hold runs through the better part of a day. Round 27 found a sixth in the same root, liquidation at a held-down price, and it is the one high accepted rather than fixed: slowing liquidations to stop it would leave real crashes to bad debt that every holder bears, so the bound is stated in plain words, the site warns a marked borrower, and the proof is kept as the measure of the bound. Every other high was fixed in the commit after the round that found it, with its proof kept as a regression test.
- The panels found their bugs in each round's newest code. That is why the vault has had more rounds than the rest: its backing guard and its lagged capital were repaired through rounds 15 to 23, each repair audited again and each found wanting in the next round, until round 23's high was in the repair made for round 22. The lag was then replaced outright by three paced figures with a one-sentence guarantee (record 23); round 24 audited that and found no high, three mediums (an ordering gap, a wrongly stated condition, and a stale collateral term nobody but its owner could re-price), each fixed or restated in the commit after it.
- Two items are accepted rather than fixed, each with its reason in the code and in Risks and open questions: a repayment one transaction before a redemption can lift what that redemption is paid, within a stated bound and only below par; and a redraw after a redemption releases a repayment's share of the fee base early. The rounds that tried to close the first did worse than the edge itself, and the records say how.
- What the reviews do not cover is in Risks and open questions: the oracle service's signer, the fixed questions, and the economic assumptions behind the peg.
The raw record of every network job, and the full text of every finding, are in the repository's docs/ folder.
Sources: docs/AUDIT-2026-10-03.md, docs/AUDIT-2026-10-04.md, docs/AUDIT-VAULT-2026-10-05.md, docs/AUDIT-ADVERSARIAL-2026-10-05.md, docs/AUDIT-FINAL-2026-10-07.md, docs/AUDIT-FINAL-PANEL-VAULT-2026-10-07.md, docs/AUDIT-SWEEP-PANEL-VAULT-2026-10-07.md, docs/AUDIT-RETRY-PANEL-VAULT-2026-10-07.md, docs/AUDIT-RETRY2-PANEL-VAULT-2026-10-08.md, docs/AUDIT-FINAL-VAULT-PANEL-2026-10-08.md, docs/AUDIT-FINAL-SWEEP-PANEL-2026-10-08.md, docs/AUDIT-DELTA-PANEL-2026-10-08.md, docs/AUDIT-LAUNCH-VAULT-PANEL-2026-10-08.md, docs/AUDIT-PACED-VAULT-PANEL-2026-10-08.md, docs/AUDIT-FINAL-SWEEP-2-2026-10-09.md, docs/AUDIT-PAYOUT-VAULT-PANEL-2026-10-09.md, docs/AUDIT-FINAL-SWEEP-3-2026-10-09.md, docs/AUDIT-FINAL-SWEEP-4-2026-10-09.md