/audits on the main site. This page summarises what each one covered.
Upstream dependency reviews
These cover the on-chain components BlackQuant’s contracts build on. They are audits of those dependencies, not of BlackQuant’s own contracts.Trail of Bits — Kiln Lagoon Vault Diff Review
A diff review of the v0.5.1-to-v0.6.0 upgrade: entry and exit fee arithmetic across the settlement, asynchronous claim and synchronous paths; the haircut mechanism for synchronous redemptions; the external sanctions-list oracle; whitelist and blacklist access modes; and the
VaultInit delegatecall and storage layout.
Deployment scripts and off-chain infrastructure were out of scope.
OpenZeppelin — Contracts v5.6 Audit
A diff audit of the Solidity library BlackQuant’s contracts inherit from: access control and
AccessManager, ERC-4337 and ERC-7579 account abstraction, the crosschain and bridge contracts, Governor, the proxy and upgradeability primitives, and the ERC-20/721/1155 token extensions.
How to read an audit report
Start with the scope section. It states the exact commits and the codebase. A report on a dependency says nothing about the code written on top of it. Check the window. A one-engineer-week review and a three-month engagement are different levels of assurance, and both are called “an audit”. Check what was excluded. Deployment scripts, off-chain infrastructure and operational security are commonly out of scope, and are commonly where problems live. Check the fix review. Findings identified is a different claim from findings resolved. Both audits above have a documented resolution status; many published reports do not.An audit is a snapshot of specific commits over a fixed window, by people who had a fixed number of days. It is evidence the code was examined carefully. It is not a proof of safety, and it does not extend to commits made afterwards.