# Vana: Hashlock Security Audit

**Client:** Vana
**Audit Date:** September 2024 (with multiple subsequent re audits through 2025)
**Project Type:** Data Sovereignty & User Owned AI Infrastructure
**Network:** EVM (Vana L1)
**Language:** Solidity (`^0.8.24`)
**Report Type:** Final Report v2
**Security Rating:** ✅ **Secure**

🔗 **Project Website:** [vana.org](https://www.vana.org)
🔗 **Hashlock Audit Page:** [hashlock.com/audits/vana](https://hashlock.com/audits/vana)

## About Vana

Vana is a distributed network for private, user owned data, designed to enable user owned AI. Users own, govern, and earn from the AI models they contribute to. Developers gain access to cross platform data to power personalized applications and train frontier AI models. The protocol introduces Data Liquidity Pools (DLPs) that allow data contributors to pool their data assets and share in the rewards generated by AI models trained on that data.

## Audit Scope

Hashlock audited the Solidity codebase of the Vana protocol through comprehensive manual line by line analysis supported by software assisted testing.

**Contracts Audited:**

| # | Contract | Function |
|---|----------|----------|
| 1 | `DataRegistryImplementation.sol` | File registry, proofs, and access permissions |
| 2 | `DataLiquidityPoolImplementation.sol` | DLP file management, contributor rewards, validation |
| 3 | `DataLiquidityPoolsRootImplementation.sol` | DLP registration, epoch management, reward distribution |
| 4 | `TeePoolImplementation.sol` | TEE (Trusted Execution Environment) pool, contribution proofs |
| 5 | `DAT.sol` | Vana token with mint, transfer, and address blocking controls |
| 6 | `TreasuryImplementation.sol` | Treasury fund management |
| 7 | `DepositImplementation.sol` | Validator deposit lifecycle |

**Audited Commit Hashes:**

- `437d1506cd7b8af76cabc8b6a052ee919c737649` (initial)
- `9d979d9df60b7aa9824209216aaf2c9faad7c0c4`
- `ec1f0f8fb069670db680bc08cbfebeb576c8480d`
- `5ffcfb40721b1ccc8e14bb843568f8711c3b779c`
- `0a930bed52ee8aab9c1def957adf3ea224ea9e1f` (final)

## Audit Findings Summary

| Severity | Count | Status |
|----------|-------|--------|
| 🔴 High | 1 | ✅ Resolved |
| 🟠 Medium | 3 | ✅ Resolved |
| 🟡 Low | 1 | ✅ Resolved |
| ⚡ Gas Optimisation | 1 | ✅ Resolved |
| 📝 QA | 3 | ✅ Resolved |

**Total findings:** 9 (all resolved)

### Notable High Severity Finding (resolved)

- **[H-01]** `TeePoolImplementation#cancelJob`: missing update of `bidAmount` after refund allowed an attacker to repeatedly call `cancelJob` and drain the contract balance. Resolved by zeroing the bid amount before transferring funds.

## Full Audit Report

📄 [Read the full audit report (PDF)](./Vana-Smart-Contract-Audit-Report-Final-Report-v2.pdf)

🌐 [View on hashlock.com](https://hashlock.com/audits/vana)

> **Note:** Hashlock has conducted multiple subsequent audits of Vana's evolving codebase (2nd and 3rd audit engagements), and has also audited **VanaTensor**, a project built on the Vana ecosystem.

## About Hashlock

Hashlock is a globally leading Web3 security firm headquartered in Australia, specializing in smart contract audits and blockchain security across the DeFi, gaming, RWA, AI, and infrastructure sectors. Our auditors come from competitive security backgrounds and have secured hundreds of protocols across the ecosystem.

**Chain agnostic with deep multi-chain expertise.** Hashlock audits any blockchain and any smart contract language. Recent engagements span Ethereum (Solidity, Vyper), Solana (Rust), Polkadot (Substrate), Cosmos (Go, CosmWasm), Aptos and Sui (Move), Starknet (Cairo), zero knowledge circuits, Bitcoin Scripts and BRC 20, plus many other ecosystems including newer Layer 1s on request.

🌐 **Website:** [hashlock.com](https://hashlock.com)
🤖 **Free AI Audit Tool:** [aiaudit.hashlock.com](https://aiaudit.hashlock.com)
📩 **Request an audit:** [Submit our RFI](https://hashlock.com/new-client-request-for-information)
📚 **More audits:** [Browse the full Hashlock Audits Repository](../../README.md)

---

_Audit conducted by Hashlock Pty Ltd. This report is published with the client's consent. For full disclaimers, methodology, and severity definitions, please refer to the complete PDF._