The current EVM contracts are immutable and have been reviewed by multiple independent auditors and a public competitive audit. All reports live in the audits directory of the source repository.
| Report |
Scope |
Date |
| Code4rena competitive audit |
The V3 protocol, reviewed publicly by a competitive audit field |
November 19 – December 10, 2025 |
| Riley Holterhus audit |
Core protocol |
November 18, 2025 |
| Riley Holterhus update |
Changes since the original review |
February 2, 2026 |
| Auctions audit — Riley Holterhus |
The Auctions contract |
February 18, 2026 |
| SignedExclusiveSwap review |
The signed exclusive swap extension |
June 30, 2026 |
| Ve33 invariants and invariant verification |
Ve33 stake backing, voter-fee and emission solvency, vote consistency, and range-aware LP rewards |
July 2, 2026 |
| AI audit scan — Apex Security Review by Cantina |
Automated review pass across the EVM contracts, Starknet contracts, governance, and the Yul router |
July 24, 2026 |
The Starknet contracts have been reviewed by Plainshift and, across several separate engagements, by Nethermind Security.
| Report |
Scope |
Date |
| Plainshift |
All Starknet contracts |
February 14, 2025 |
| Nethermind Security — core contracts (partially redacted) |
Core, router, positions and NFT contracts — a fifteen engineer-week review of 4,044 lines |
March 22, 2024 |
| Nethermind Security — TWAMM extension |
The TWAMM extension, which powers DCA-enabled pools and DCA orders — a six engineer-week review of 1,681 lines |
April 4, 2024 |
| Nethermind Security — revenue buybacks |
The first version of the revenue buybacks contract |
September 2, 2024 |
| Nethermind Security — limit orders extension |
The limit orders extension, for which order placement is now deprecated — a six engineer-week review of 568 lines |
January 6, 2025 |
| Report |
Scope |
Date |
| Cairo Security Clan |
The Starknet L1 proxy, which lets Starknet governance control contracts on Ethereum |
January 22, 2025 |
| AI audit scan — Apex Security Review by Cantina |
Automated review pass; its scope included the governance contracts |
July 24, 2026 |
Audits of the deprecated EVM V2 deployment
These reports cover the EVM V2 contracts, which are deprecated and superseded by V3. They are retained for reference only.
| Report |
Scope |
Date |
| Plainshift |
The V2 deployment: core, periphery and the Oracle extension |
February 24 – March 17, 2025 |
| ABDK |
V2 core |
April 1, 2025 |
| ABDK |
V2 TWAMM |
April 27, 2025 |
| ABDK |
V2 TWAMM invariant analysis |
April 12, 2025 |