Contract security and audit status
Every deployed contract, its review state, and how to report a vulnerability.
No external third-party audit report has been published yet. Contracts below have passed internal review, fuzzing and invariant testing only. Do not treat any contract as externally audited until a signed report is linked on this page.
This register is the single public source of truth for audit status. It is updated the day a report is delivered, and the report PDF is published here in full — including unresolved findings.
Deployed contracts (Base mainnet)
$TRUST token (ERC-20)
Internal review onlyFixed 1,000,000,000 supply, transfer logic, ownership, no mint after deploy.
Presale vault
Internal review onlyUSDC intake, tier pricing, allocation accounting, withdrawal to treasury.
Treasury Safe (multisig)
Internal review onlyGnosis Safe holding protocol funds; all treasury movement requires signer approval.
Treasury wallet
Internal review onlyReward-pool distribution source for streaks, quests and referrals.
Internal review scope
- Reentrancy and external-call ordering on every state-changing function.
- Integer overflow / underflow (Solidity 0.8 checked arithmetic).
- Access control: owner-only and Safe-only paths, no unguarded selfdestruct or delegatecall.
- Fixed supply verification — no post-deploy mint path on the token contract.
- Fuzz and invariant suites (Foundry) plus Monte-Carlo simulation of the sale accounting.
- Front-running and price-tier manipulation review on the presale intake path.
Contract sources are open under contracts/ and contracts/v2/ in the public repository, so anyone can reproduce these checks independently.
Report a vulnerability
Please disclose responsibly: email a description, impact assessment and reproduction steps. Do not open a public issue, and do not exploit user funds. We acknowledge within 48 hours and coordinate a fix and disclosure window with you.