# Hashlock Security Audits

> Public repository of smart contract security audits and Web3 penetration testing engagements conducted by **Hashlock**, a globally leading Web3 security firm headquartered in Australia.

[![Website](https://img.shields.io/badge/Website-hashlock.com-00C49A)](https://hashlock.com)
[![Audits](https://img.shields.io/badge/Audits%20Directory-hashlock.com%2Faudits-blue)](https://hashlock.com/audits)
[![AI Audit Tool](https://img.shields.io/badge/Free%20Tool-aiaudit.hashlock.com-orange)](https://aiaudit.hashlock.com)
[![Twitter](https://img.shields.io/badge/Twitter-@Hashlock__-1DA1F2)](https://x.com/Hashlock_)
[![License](https://img.shields.io/badge/License-MIT-yellow)](./LICENSE)

## What Hashlock Does

Hashlock secures the Web3 ecosystem through manual smart contract audits, tokenomics reviews, penetration testing, bug bounty operations, and ongoing security advisory. We are **chain agnostic with deep multi-chain expertise**. We audit any blockchain and any smart contract language, and our public portfolio includes hundreds of engagements on Ethereum, Solana, Polkadot, Cosmos, Aptos, Sui, Starknet, Bitcoin, zero knowledge circuits, and many other ecosystems, including newer and emerging Layer 1s on request. Our auditors come from competitive security backgrounds with proven results in public security competitions and bug bounty programs.

## Notable Clients

> **Chain agnostic by capability, multi-chain by experience.**

🚀 **Recent and recognized engagements**. Names recognised across the Web3 industry:

[**Rocket Pool**](./clients/rocket-pool/) (Ethereum liquid staking) ·
[**1inch**](./clients/1inch/) (DeFi aggregation) ·
[**SushiSwap**](./clients/sushi-swap/) (multi chain DEX) ·
[**Gala**](./clients/gala/) (Web3 gaming) ·
[**P2P**](./clients/p2p/) (institutional staking) ·
[**Vana**](./clients/vana/) (user owned AI data) ·
[**EigenLayer**](./clients/eigenlayer-contest/) (restaking) ·
[**Energy Web**](./clients/energy-web/) (Polkadot infrastructure) ·
[**Manifest**](./clients/manifest/) (Cosmos appchain) ·
[**Spicenet**](./clients/spicenet/) (Solana DeFi infrastructure)

## What's in This Repository

Hundreds of security audit engagements conducted by Hashlock across Web3. We are **chain agnostic with deep multi-chain expertise**. Our portfolio spans smart contracts, blockchain protocols, dApps, and infrastructure across every major ecosystem we've engaged with to date, including **Ethereum, Solana, Avalanche, BNB Chain, Polygon, Arbitrum, Base, Berachain, Cosmos, Polkadot, Starknet, Sui, Aptos, Near, Kadena, Stacks, Bitcoin**, and many more. If your chain is not listed, we audit it too.

Each client folder contains:

- 📄 **Public engagements**: full audit report PDF with findings, severity ratings, and remediation status
- 🔒 **NDA engagements**: audit confirmation under client confidentiality

**Legend:** 🛡️ Hashlocked tier · 🐛 Active Bug Bounty Program · _NDA_ full report confidential

## Browse the Portfolio

### By Ecosystem

🟦 [Ethereum & EVM Audits](./docs/categories/ethereum.md)  ·  🟣 [Solana Audits](./docs/categories/solana.md)  ·  🔴 [Polkadot Audits](./docs/categories/polkadot.md)  ·  🌌 [Cosmos Audits](./docs/categories/cosmos.md)

### By Category

💰 [DeFi Audits](./docs/categories/defi.md)  ·  🎮 [Gaming Audits](./docs/categories/gaming.md)  ·  🏛️ [RWA Audits](./docs/categories/rwa.md)  ·  🛡️ [Hashlocked Projects](./docs/categories/hashlocked.md)  ·  🔒 [NDA Engagements](./docs/categories/nda.md)

### Security Documentation

📋 [Methodology](./docs/methodology.md)  ·  ⚖️ [Severity Definitions](./docs/severity-definitions.md)  ·  ⏱️ [Audit Process](./docs/audit-process.md)  ·  ❓ [FAQ](./docs/faq.md)  ·  🎯 [How to Choose an Auditor](./docs/how-to-choose-an-auditor.md)

### Machine Readable Index

📊 [audits.json](./audits.json). Full client portfolio in JSON for developers, AI systems, and integrations.

---

## Featured Audits

The most prominent projects featured on [hashlock.com/audits](https://hashlock.com/audits), in order of recency.

- [**1inch**](./clients/1inch/) _NDA_
- [**Rocket Pool**](./clients/rocket-pool/)
- [**P2P**](./clients/p2p/) _NDA_
- [**SushiSwap**](./clients/sushi-swap/) _NDA_
- [**Gala**](./clients/gala/)
- [**Manifest**](./clients/manifest/) 🛡️ 🐛
- [**EigenLayer Competition**](./clients/eigenlayer-contest/)
- [**Spicenet**](./clients/spicenet/) 🛡️
- [**Vana**](./clients/vana/)
- [**Energy Web**](./clients/energy-web/) 🛡️
- [**Space and Time**](./clients/space-and-time/) _NDA_
- [**peaq**](./clients/peaq/) _NDA_
- [**Celo**](./clients/celo/)
- [**glue**](./clients/glue/)
- [**U2U**](./clients/u2u/)
- [**Algem**](./clients/algem/)
- [**Allbridge**](./clients/allbridge/) _NDA_
- [**Kadena**](./clients/kadena/)
- [**OpenZK**](./clients/openzk/)
- [**Balanced Network (Icon Foundation)**](./clients/balanced-network-icon-foundation/) 🐛
- [**Nexa**](./clients/nexa/)
- [**Silencio**](./clients/silencio/) _NDA_
- [**Redbelly Network**](./clients/redbelly-network/) _NDA_
- [**Beamable Network**](./clients/beamable-network/)
- [**Shezmu**](./clients/shezmu/)
- [**Primus Labs**](./clients/primus-labs/)
- [**Nodo**](./clients/nodo/)
- [**Sogni**](./clients/sogni/) _NDA_
- [**Lilypad**](./clients/lilypad/)
- [**Kingdomly**](./clients/kingdomly/)

[📂 Browse all public audits below](#all-audits-public-reports) or jump to [NDA engagements](#audited-by-hashlock--nda-engagements).

---

## All Audits (Public Reports)

The following projects have published their full Hashlock audit reports. Open each folder for the detailed README and PDF.

_The full alphabetical list of public audit reports is preserved below for completeness. We recommend using the [category pages](./docs/categories/) above for filtered browsing._

<!-- AUTO:PUBLIC:BEGIN (generated by update-index.ps1 from audits.json; do not edit by hand) -->
- [**1001 Squares of NFT**](./clients/1001-squares-of-nft/)
- [**1Gogh**](./clients/1gogh/)
- [**1walletwins**](./clients/1walletwins/)
- [**5ire**](./clients/5ire/)
- [**a51 Finance**](./clients/a51-finance/)
- [**Adil Chain**](./clients/adil-chain/)
- [**Aegis**](./clients/aegis/)
- [**AgriDex**](./clients/agridex/)
- [**AI Protocol**](./clients/ai-protocol/)
- [**Algem**](./clients/algem/)
- [**Allfeat**](./clients/allfeat/)
- [**Aqualis**](./clients/aqualis/)
- [**Arcane**](./clients/arcane/)
- [**Aria Land**](./clients/aria-land/)
- [**AskJimmy**](./clients/askjimmy/)
- [**Avail**](./clients/avail/)
- [**Bad Development**](./clients/baddevelopment/)
- [**Balanced Network (Icon Foundation)**](./clients/balanced-network-icon-foundation/) 🐛
- [**Balloon**](./clients/balloon/)
- [**Beamable Network**](./clients/beamable-network/)
- [**Best In Slot**](./clients/best-in-slot/)
- [**Bethel**](./clients/bethel/)
- [**BiohackerDAO**](./clients/biohackerdao/)
- [**BitcoinTAF (BTAF)**](./clients/btaf-token-audit/)
- [**Black Tie**](./clients/black-tie/)
- [**Blockchat**](./clients/blockchat/)
- [**Blocknite**](./clients/blocknite/)
- [**Blockstreet**](./clients/blockstreet/)
- [**BoohooBear**](./clients/boohoobear/)
- [**Bundle**](./clients/bundle/)
- [**Cabal Labs**](./clients/cabal-labs/)
- [**Cache Wallet**](./clients/cache-wallet/)
- [**Carbonmark**](./clients/carbonmark/)
- [**Cartha**](./clients/cartha/)
- [**Catapult**](./clients/catapult/)
- [**CatSwap**](./clients/catswap/)
- [**Celo**](./clients/celo/)
- [**CereBree**](./clients/cerebree/)
- [**Chedda Finance**](./clients/chedda-finance/)
- [**Chirper AI**](./clients/chirper-ai/)
- [**Coinsub**](./clients/coinsub/)
- [**CoPump**](./clients/copump/)
- [**Credbull**](./clients/credbull/)
- [**CrossCurve**](./clients/crosscurve/)
- [**Cryptaine**](./clients/cryptaine/)
- [**Cryptopunks Outbid**](./clients/cryptopunks-outbid/)
- [**DB Cherry**](./clients/db-cherry/)
- [**Debita Finance**](./clients/debita-finance/)
- [**Dedcat**](./clients/dedcat/)
- [**Defi Bull World**](./clients/defi-bull-world/)
- [**DelNorte**](./clients/delnorte/)
- [**Diffuse**](./clients/diffuse/)
- [**DigiShares**](./clients/digishares/)
- [**Dione**](./clients/dione/)
- [**DrDoge**](./clients/drdoge/)
- [**dTRINITY**](./clients/dtrinity/)
- [**Dunback Meadow**](./clients/dunback-meadow/)
- [**DVX**](./clients/dvx/)
- [**EIG Global Trust**](./clients/eig-global-trust/)
- [**EigenLayer Competition**](./clients/eigenlayer-contest/)
- [**Emergence.art**](./clients/emergence-art/)
- [**Energy Web**](./clients/energy-web/)
- [**Enni**](./clients/enni/)
- [**ewe technology**](./clients/ewe-technology/)
- [**Exactly Protocol**](./clients/exactly-protocol/)
- [**Finceptor**](./clients/finceptor/)
- [**Flamatech**](./clients/flamatech/)
- [**FlareBank**](./clients/flarebank/)
- [**Fluidity Money**](./clients/fluidity-money-audit/)
- [**ForeGate**](./clients/foregate/)
- [**Forte AUD**](./clients/forte-aud/)
- [**Frenly**](./clients/frenly/)
- [**FROGY**](./clients/frogy/)
- [**Functionland**](./clients/functionland/) 🐛
- [**Futurity Galaxies**](./clients/futurity-galaxies/)
- [**FX1**](./clients/fx1/)
- [**Gala**](./clients/gala/)
- [**glue**](./clients/glue/)
- [**Haiku**](./clients/haiku/)
- [**Hann Finance**](./clients/hann-finance/)
- [**Haven**](./clients/haven/)
- [**Haven1**](./clients/haven1/)
- [**Hedgecast AI**](./clients/hedgecast-ai/)
- [**helder**](./clients/helder/)
- [**Hikari Finance**](./clients/hikari-finance/)
- [**Honeypot**](./clients/honeypot-finance/)
- [**Honk**](./clients/honk/)
- [**HyperCroc**](./clients/hypercroc/)
- [**HySwap**](./clients/hyswap/)
- [**IGNA**](./clients/igna/)
- [**IMF**](./clients/imf-international-meme-fund/) 🐛
- [**Immersve**](./clients/immersve/)
- [**Immutable Ratings**](./clients/immutable-ratings/)
- [**Indie.Fun**](./clients/indie-fun/)
- [**INDX**](./clients/indx/)
- [**Intiva Health**](./clients/intiva-health/)
- [**Ithaca Protocol**](./clients/ithaca-protocol/)
- [**IvyFi**](./clients/ivyfi/)
- [**Jedai**](./clients/jedai/)
- [**Jubi DAO**](./clients/jubi/)
- [**JuicyFi**](./clients/juicyfi/)
- [**K613**](./clients/k613/)
- [**Kadena**](./clients/kadena/)
- [**Kingdomly**](./clients/kingdomly/)
- [**Kirapay**](./clients/kirapay/)
- [**Klima Protocol**](./clients/klima-protocol/)
- [**Layer Labs**](./clients/layer-labs/)
- [**Layer One X**](./clients/layer-one-x/)
- [**LazyMog**](./clients/lazymog/)
- [**Lend**](./clients/lend/)
- [**Levva**](./clients/levva/)
- [**LFG**](./clients/lfg/)
- [**Libertum**](./clients/libertum/)
- [**Lilypad**](./clients/lilypad/)
- [**Line Next**](./clients/line-next/)
- [**Liquido**](./clients/liquido/)
- [**Livermore AI**](./clients/livermore-ai/)
- [**Lizard Labs**](./clients/lizard-labs/)
- [**Loadout**](./clients/loadout/)
- [**Lockon**](./clients/lockon/)
- [**Longtail**](./clients/longtail/)
- [**LottoPGF**](./clients/lottopgf/)
- [**Lucid Labs**](./clients/lucid-labs/)
- [**Lynx Finance**](./clients/lynx-finance/)
- [**Mad Cartels**](./clients/mad-cartels/)
- [**Manifest**](./clients/manifest/) 🐛
- [**MarketDAO**](./clients/marketdao/)
- [**Mavan**](./clients/mavan/)
- [**Mavryk**](./clients/mavryk/)
- [**Max**](./clients/max/)
- [**MediChainX**](./clients/medichainx-medxt/)
- [**Metaversal**](./clients/metaversal/)
- [**MezFi**](./clients/mezfi/)
- [**MindDAO**](./clients/minddao/)
- [**Miracle World**](./clients/miracle-world/)
- [**MiracleDigithread**](./clients/miracledigithread/)
- [**Molecula**](./clients/molecula/)
- [**Monstro**](./clients/monstro/)
- [**Montage Token**](./clients/montage-token/)
- [**Moonopol**](./clients/moonopol/)
- [**Moria**](./clients/moria/)
- [**MortgageFi**](./clients/mortgagefi/)
- [**MyDexBot**](./clients/mydexbot/)
- [**Myshell**](./clients/myshell/)
- [**Mytho**](./clients/mytho/)
- [**N4T**](./clients/n4t/)
- [**Narra Layer**](./clients/narra-layer/)
- [**Natix Network**](./clients/natix-network/)
- [**Nav Finance**](./clients/nav-finance/)
- [**Nebula**](./clients/nebula/)
- [**Neomi**](./clients/neomi/)
- [**Nexa**](./clients/nexa/)
- [**Nexus**](./clients/nexus/)
- [**Nodo**](./clients/nodo/)
- [**Noon Capital**](./clients/noon-capital/)
- [**NOTE Protocol**](./clients/note-protocol/)
- [**OmniSwap**](./clients/omniswap/)
- [**OnlyUp**](./clients/onlyup/)
- [**OObleck**](./clients/oobleck/)
- [**OpenGradient**](./clients/opengradient/)
- [**OpenZK**](./clients/openzk/)
- [**Orbis**](./clients/orbis/)
- [**Orlyn**](./clients/orlyn/)
- [**PandaPump**](./clients/pandapump/)
- [**ParagonsDAO**](./clients/paragonsdao/) 🐛
- [**Paymatic**](./clients/paymatic/)
- [**Peacepal AI**](./clients/peacepal-ai/)
- [**Perena**](./clients/perena/)
- [**Petcoin AI**](./clients/petcoin-ai/)
- [**Pheasant Network**](./clients/pheasant-network/)
- [**PickYesNo**](./clients/pickyesno/)
- [**Pier Two**](./clients/pier-two/)
- [**PING**](./clients/ping/)
- [**PinLink**](./clients/pinlink/)
- [**Polymesh**](./clients/polymesh/)
- [**Ponz**](./clients/ponz/)
- [**PoolOrbit**](./clients/poolorbit/)
- [**PoolParty**](./clients/poolparty/)
- [**Posse Studios**](./clients/posse-studios/)
- [**PredMart**](./clients/predmart/)
- [**PrimeInsights**](./clients/primeinsights/)
- [**Primus Labs**](./clients/primus-labs/)
- [**Prophet Markets**](./clients/prophet-markets/)
- [**Propto**](./clients/propto/)
- [**Pruv Finance**](./clients/pruv-finance/)
- [**qerra**](./clients/qerra/)
- [**Quant.Fun**](./clients/quant-fun/)
- [**r/datadao**](./clients/rdatadao/) 🐛
- [**Rakurai**](./clients/rakurai/)
- [**Rank Trading**](./clients/rank-trading/)
- [**RDDTOR**](./clients/rddtor/)
- [**Rebase Finance**](./clients/rebase-finance/)
- [**RGB**](./clients/rgb/)
- [**Rocket Pool**](./clients/rocket-pool/)
- [**Rocksolid**](./clients/rocksolid/)
- [**Root Network**](./clients/root-token/)
- [**Rubicon**](./clients/rubicon/)
- [**SafeHaven Exchange**](./clients/safehaven-exchange/)
- [**SatLayer**](./clients/satlayer/)
- [**Scall**](./clients/scall/)
- [**Scout Game**](./clients/scout-game/)
- [**Sensay.io**](./clients/sensay-io/)
- [**Shezmu**](./clients/shezmu/)
- [**Shiba Classic**](./clients/shiba-classic/)
- [**SHSY**](./clients/shsy/)
- [**Silverswap**](./clients/silverswap/)
- [**Size Credit**](./clients/size-credit/)
- [**Soarchain**](./clients/soarchain/)
- [**Spectrum Staking**](./clients/spectrum-staking/)
- [**SPICE**](./clients/spice/)
- [**Spicenet**](./clients/spicenet/)
- [**Spiral Stake**](./clients/spiral-stake/)
- [**STBL**](./clients/stbl/)
- [**Steer Protocol**](./clients/steer-protocol/)
- [**Stoneii**](./clients/stoneii/)
- [**Superset**](./clients/superset/)
- [**SwarmBase**](./clients/swarmbase/)
- [**T-Rize**](./clients/t-rize/)
- [**Talisman**](./clients/talisman/)
- [**Tand3m**](./clients/tand3m/)
- [**TapSwap**](./clients/tapswap/)
- [**tBTC**](./clients/tbtc/)
- [**Teneo**](./clients/teneo/)
- [**Tenexium**](./clients/tenexium/)
- [**The Winners Circle**](./clients/the-winners-circle/)
- [**Together Fun**](./clients/together-fun/)
- [**Tomcat**](./clients/tomcat/)
- [**Tons Money**](./clients/tons-money/)
- [**U2U**](./clients/u2u/)
- [**Ulalo**](./clients/ulalo/)
- [**Umbrae**](./clients/umbrae/)
- [**Urbit Token**](./clients/urbit-token/)
- [**Vana**](./clients/vana/)
- [**VanaTensor**](./clients/vanatensor/)
- [**Veera**](./clients/veera/)
- [**Verida Protocol**](./clients/verida-protocol-audit/)
- [**VIA Labs**](./clients/via-labs/)
- [**Vield**](./clients/vield/)
- [**Virovita**](./clients/virovita/)
- [**Voyager**](./clients/voyager/)
- [**Vrine**](./clients/vrine/)
- [**Wayfinder**](./clients/wayfinder/)
- [**World3.ai**](./clients/world3-ai/)
- [**WORM**](./clients/worm/)
- [**XBO**](./clients/xbo/)
- [**XMAQUINA**](./clients/xmaquina/)
- [**Yieldo**](./clients/yieldo/)
- [**YKYR**](./clients/ykyr/)
- [**YOM**](./clients/yom/)
- [**Your Wallet**](./clients/your-wallet/)
- [**Zero Edge**](./clients/zero-edge/)
- [**ZetaChain**](./clients/zetachain/)
- [**Zeus Exchange**](./clients/zeus-exchange/)
- [**Zilliqa**](./clients/zilliqa/)

_254 public audit engagements._
<!-- AUTO:PUBLIC:END -->
---

## Audited by Hashlock (NDA Engagements)

The following projects have engaged Hashlock for security audits where the full report remains under client confidentiality. The engagement itself is publicly disclosed on [hashlock.com/audits](https://hashlock.com/audits).

<!-- AUTO:NDA:BEGIN (generated by update-index.ps1 from audits.json; do not edit by hand) -->
- [**1inch**](./clients/1inch/)
- [**Allbridge**](./clients/allbridge/)
- [**Archie**](./clients/archie/)
- [**Aveforge**](./clients/aveforge/)
- [**FVC**](./clients/fvc/)
- [**Lotus Finance**](./clients/lotus-finance/)
- [**Memez.GG**](./clients/memez-gg/)
- [**Midnight**](./clients/midnight/)
- [**Onyx**](./clients/onyx/)
- [**P2P**](./clients/p2p/)
- [**Parasail**](./clients/parasail/)
- [**Passphrase**](./clients/passphrase/)
- [**peaq**](./clients/peaq/)
- [**Potomac Capital Limited**](./clients/potomac-capital-limited/)
- [**Redbelly Network**](./clients/redbelly-network/)
- [**Rock Tournaments**](./clients/rock-tournaments/)
- [**RPS Labs**](./clients/rps/)
- [**Silencio**](./clients/silencio/)
- [**Sogni**](./clients/sogni/)
- [**Space and Time**](./clients/space-and-time/)
- [**SushiSwap**](./clients/sushi-swap/)
- [**Tecnodes Network**](./clients/tecnodes-network/)
- [**Topos**](./clients/topos/)
- [**World Mobile**](./clients/world-mobile/)
- [**Zapme**](./clients/zapme/)
- [**Zenchain**](./clients/zenchain/)

_26 NDA engagements._
<!-- AUTO:NDA:END -->
---

## About Hashlock

Hashlock is a globally leading Web3 security firm headquartered in Australia, specializing in smart contract audits and blockchain security across the DeFi, gaming, RWA, AI, and infrastructure sectors. Our auditors come from competitive security backgrounds and have secured hundreds of protocols across the ecosystem.

### Languages & Ecosystems (Selected Examples)

Hashlock is **chain agnostic with deep multi-chain expertise**. We audit any blockchain and any smart contract language. Selected examples from our portfolio:

- **EVM (Solidity, Vyper)**: Ethereum, Polygon, Arbitrum, Base, BNB Chain, Avalanche, Berachain, Optimism, and many other EVM compatible chains
- **Solana (Rust)**: native programs and Anchor framework
- **Polkadot, Kusama (Rust, Substrate)**: custom pallets, parachains, runtime modules, XCM
- **Cosmos ecosystem (Go, CosmWasm)**: Cosmos SDK appchains, IBC integrations
- **Aptos, Sui (Move)**: resource semantics, object ownership, abilities
- **Starknet (Cairo)**: smart contracts and ZK proof systems
- **Zero knowledge circuits**: Noir, Circom, and other proving stacks
- **Bitcoin**: Bitcoin Scripts, BRC 20, Ordinals, Runes
- **Other ecosystems we have audited**: Near, Kadena, Stacks, Mavryk, ICP, Cardano, Algorand, Tron, Tezos, and more
- **Any other blockchain or smart contract language on request**, including newer Layer 1s, emerging VMs, and novel cryptographic protocols

If your chain or language is not listed above, contact us. We adapt to any codebase.

### Core Services

- **Smart Contract Audits**: manual, line by line security reviews
- **Tokenomics Audits**: token model and incentive design reviews
- **Penetration Testing**: application and infrastructure security testing
- **Bug Bounty Program Management**: run on Hashlock's own bug bounty platform
- **vCISO & Security Advisory**: ongoing security leadership
- **CCSS Certification Support**: Cryptocurrency Security Standard compliance
- **[Free AI Audit Tool](https://aiaudit.hashlock.com)**: powered by custom tuned LLMs trained on real audit data

### Resources

🌐 **Website:** [hashlock.com](https://hashlock.com)
📋 **Audits Directory:** [hashlock.com/audits](https://hashlock.com/audits)
🤖 **Free AI Audit Tool:** [aiaudit.hashlock.com](https://aiaudit.hashlock.com)
📩 **Request an Audit:** [Submit our RFI form](https://hashlock.com/new-client-request-for-information)
🐦 **X / Twitter:** [@Hashlock_](https://x.com/Hashlock_)

---

## Contact

Need a security audit, penetration test, or ongoing security advisory? [Reach out to our team](https://hashlock.com/new-client-request-for-information). We work with projects from pre launch startups to established protocols across every major blockchain ecosystem.

For questions about this repository, open an issue or contact us at info@hashlock.com.au.

---

_All audit reports in this repository are published with client consent. Hashlock retains ownership of report content per our standard engagement terms. For full disclaimers, methodology, and severity definitions, please refer to each individual audit report PDF._