Audits
The status of every security review of the Tuo contracts, with report links added as they become available.
Tuo does not describe itself as audited. An internal audit-readiness review is complete. The independent external review that gates the mainnet deployment has not started. This page is the single place where that status is kept current.
No independent third party has reviewed the Tuo contracts yet. Do not treat the internal review below as an audit. Mainnet launch is blocked until the external review closes every critical and high severity finding.
Timeline
| Date | Review | Scope | Outcome | Report |
|---|---|---|---|---|
| 2026-09-08 | Internal audit-readiness review | All contracts under apps/contracts/src | 0 critical, 0 high. Static analysis with Slither: 0 real findings. A batch of ABI-neutral and storage-layout-neutral fixes shipped | Internal |
| To be announced | Independent external review | Same scope plus the Uniswap V3, aggregator and Hyperliquid bridge integrations | Pending. Firm to be announced | Published here when final |
| After launch | Second independent review | Full scope | Planned. Together with a bug bounty, this is the gate for lifting the per-position cap | Published here when final |
What the internal review covered
The internal review was run against the commit recorded in the auditor note that accompanies the contracts. It combined a manual pass over every source file, automated review agents, and static analysis. Its purpose was to make the external review efficient, not to replace it.
Facts a reader can reproduce from the repository:
| Item | Value |
|---|---|
| Solidity | 0.8.26, pinned |
| Toolchain | Foundry 1.5.1, via_ir, optimizer runs 200, EVM version cancun |
| Dependencies | OpenZeppelin Contracts 5.6.1, Uniswap v3-core 1.0.2 (solc 0.8) |
| Test suite | 311 tests: 301 pass, 10 fork tests skip without an archive RPC |
| Invariants | I1 to I10, run by a hostile-keeper fuzz harness (1,000 runs x 128 depth under the CI profile) |
TuoVault runtime size | 23,250 bytes, 1,326 bytes below the EIP-170 ceiling |
The invariants are listed in plain language on Architecture.
Known deviations disclosed to reviewers
The contracts ship with a written note for auditors that lists every deliberate design decision Tuo would rather have challenged than rediscovered. The headline items are public and are covered in the Risks section:
- Pricing is pool-native TWAP only. There is no Chainlink feed and no oracle registry.
- The hedge leg leaves on-chain custody while a hedge is open.
- The Hyperliquid operator set is a treasury-mutable allowlist, and the one-operator-per-position rule is enforced off-chain, not by the vault.
- A final margin return is a keeper attestation with balance-sheet effect, bounded by an armed withdrawal request.
- Aggregator retirement is a treasury lever over every swap, but never over the USDC exit or the in-kind emergency exit, which need no swap.
emergencyWithdrawis MEV-exposed by construction. The protected path isrequestWithdrawthenwithdraw.
What lifts the cap
The guarded launch caps every position at 25,000 USDC. Lifting that cap requires two independent reviews and a live bug bounty. See Guarded launch.
Reporting a vulnerability
If you find something before the external review does, please use the process on Bug bounty and disclosure.