Reader objective
Translate technical assurance into an advisor decision record.
Define the exact code path
Record the deployed contract addresses, network, implementation version, proxy structure, market or vault, and every contract called in the normal deposit and withdrawal path. Protocol brands often contain several products with different code and administrators.
Read audits as scoped evidence
For each audit, record firm, date, commit hash, scope, exclusions, findings, remediation, and whether deployed code matches reviewed code. Count is less important than relevance. Formal verification can prove specified properties; it cannot prove that the specification captured every economic failure.
Who can change the code
- Upgradeable proxy administrator
- Pause or emergency powers
- Governance proposal and execution thresholds
- Timelocks and security councils
- Oracle and collateral parameter setters
- Front-end or API dependencies
An immutable protocol trades repairability for predictability. An upgradeable protocol trades adaptability for administrative risk. Neither label decides suitability by itself.
The failure class that keeps beating audits
The failure worth studying from 2026 was not a bug in staking logic. In April an attacker forged a message to Kelp's LayerZero bridge and released about 116,500 rsETH, roughly 18% of circulating supply and near $293M, with no ETH ever locked on the source side. The lesson is scope: for any wrapped or bridged asset, the bridge is the asset's security model, and it is usually the least examined contract in the stack. The adverse research memo carries the full account.
A month earlier the same failure class appeared at smaller scale: a double-minting vulnerability in a Solv vault contract created unbacked tokens in a system whose entire premise is one-to-one backing. $2.7M, since fixed, and the class of bug matters more than the amount. The unresolved research memo is published too. The question an advisor can actually ask is not “how many audits” but “was the minting path, including every bridge, inside any audit's scope?”
History and live monitoring
Review exploits, bad debt, near misses, governance failures, oracle incidents, bridge failures, and response quality. Then define live triggers: code upgrade, new admin, shortened timelock, oracle change, unexpected pause, unaudited market, or loss event. Smart-contract diligence expires whenever the code or authority changes.