Audit reports

Security reports published by Trilocore. Each report covers one finding, and each carries a verdict from replaying that finding against a mainnet fork in the Auditing IDE — the reproduction is run before the report is written, not claimed after it.

Reports are written by the auditor who ran the session and published by hand to this site. A report describing a live contract goes up only once the affected party has remediated or has agreed to publication; reports against synthetic targets have nothing to disclose and are published as teaching material. Today this index holds a single illustrative example, labelled as such at the top of the page.

What a report contains

Every report opens with the same header fields.

Field	Meaning
target	the contract address the fork session was opened against
date	the date the reproduction was run
severity	one of the five levels below
verdict	REPRODUCED — the finding replayed against the fork · NOT REPRODUCED — it did not
profit_wei	the value that moved during the reproduction, in wei, where the finding moves value

The body then follows a fixed shape: summary, the vulnerability in source or bytecode, how it was reproduced, a runnable proof of concept, impact, and mitigation.

Severity

Severity is a judgement about impact and precondition, not a score. Trilocore uses the same five levels here as the findings ledger inside a workspace, so a published report and a workspace finding can be compared directly.

Level	Meaning
critical	Unconditional loss of user or protocol funds, or loss of contract control, reachable by any unprivileged caller. No unusual market state or privileged cooperation required.
high	Significant loss of funds or a permanent freeze, but gated behind a precondition — a specific market state, a governance step, or a counterparty acting first.
medium	Bounded loss, denial of service on a non-critical path, or an accounting error a privileged party can correct after the fact.
low	No direct loss. A deviation from the documented behaviour, or a hardening gap that widens the attack surface for some future change.
info	Correct as written, but worth recording: gas, style, documentation, or a risk that only materialises if the contract is extended.

A report states the severity it was assigned and why. Where the finding is reachable only under a precondition, that precondition is named in the summary rather than buried in the impact section.

Attestations

Audits run inside a Trilocore workspace can additionally be sealed as an Audit Passport — a hash-chained, RS256-signed record of the audit that a third party can verify against the platform's published keys. The verification endpoints are documented in the public API reference.

The reports on this site are static documents; they are not attested, and they are not a substitute for an engagement.

Responsible disclosure

Trilocore practises coordinated disclosure. If you have found a vulnerability — in a contract we have written about, or in Trilocore's own products and site — write to security@trilocore.com and give us a reasonable window to remediate before going public. The full policy is published at trilocore.com/.well-known/security.txt.

When testing against our services: do not access or modify data that is not yours, and do not degrade the service for anyone else. Research against your own forks is always fine — that is what the Auditing IDE is for.