Audits
Current status: no audit has been completed.
Where things stand
The vault contracts have not been audited. No report exists, and none is scheduled for publication yet. Deposits are open anyway, so this page is the risk you are taking rather than a future concern.
Treat any claim that UNIVAULT is audited as false until a report is linked from this page. This page is the only place we will publish one.
What does exist is verified source. All twelve deployed contracts — three vaults, three oracles, three keeper guards, two basket adapters and the exit router — are source-verified on Blockscout, so the explorer shows the Solidity that produced the running bytecode instead of the bytecode alone. That means you can read exactly what every function does before sending anything.
Verified source is not an audit and does not substitute for one. It proves the published code is the code that runs. It says nothing about whether that code has a bug in it, and an unaudited contract can be perfectly verified and still lose your money.
Before deposits open
- Full test coverage against forked mainnet state.
- An external audit, published in full including findings we did not fix.
- A deposit cap during the initial period.