Changelog

Dated record of changes to the Tuo protocol, its deployments, its security reviews and this documentation.

Entries are newest first. Deployment addresses and audit reports are added here as they land, with a link to the page that holds the detail.

How to read this page

Protocol entries describe a change to the deployed contracts, their configuration or a product policy. Because the contracts are immutable, a contract change always means a new deployment and is listed with its addresses.
Deployment entries record a new network or a new contract set, with the deploy block and verified-source links.
Security entries record audit reports, disclosed findings and their resolution, and bug bounty milestones.
Documentation entries record material changes to this site. Wording fixes are not listed.

Every entry carries the date it took effect, not the date it was written.

Documentation published. First public version of this site. It covers:

What Tuo is, who it is for and the custody model, including the hedge-leg qualification.
The full position lifecycle: concentrated liquidity, hedging on Hyperliquid, Engine v25, valuation and withdrawals.
The two products, Basis Plus Core and Delta Hedge Standalone, with their sleeves, ranges and hedge models.
The 30% performance fee, every venue and bridge cost a position pays, and a worked example.
Risks: market and strategy, counterparty and venue, smart contract and oracle, operational.
Security: roles and admin controls, the guarded launch, audit status and disclosure.
Smart contracts: architecture, protocol parameters, events for integrators, deployed addresses and the BUSL-1.1 licence.

Status at publication:

Target network is Arbitrum One. The mainnet deployment has not happened yet.
An Arbitrum Sepolia rehearsal deployment exists and predates the current contract ABI. It is listed for reference only.
Internal audit-readiness review of the contracts completed 2026-09-08. Independent external review pending.
Bug bounty planned for after launch.

Arbitrum One deployment: addresses, deploy block and verified-source links.
External audit report and the list of resolved findings.
Bug bounty launch, scope and reward tiers.
Any change to protocol parameters, allowlists or product policies made by the treasury.