Audit Reports
Independent security assessments of every Velox smart contract. Full transparency on findings, severity classifications, and remediation timelines — because trust requires proof.
Audit Philosophy
Velox commissions independent security audits from multiple tier-one blockchain security firms before every major contract deployment. Each audit covers the full Solidity codebase, on-chain execution paths, gas-sponsorship mechanics, and token custody logic. Reports are published in full — no redactions, no omissions.
We follow a continuous audit cycle: every protocol upgrade triggers a fresh review, and every remediated finding is confirmed by the original auditor before the updated contract is deployed to TRON mainnet. Current deployments are covered by audits from Trail of Bits, Halborn, and SlowMist.
Audit History
Every audit engagement is listed below with its scope, findings summary, and current status. Click any report link to download the full PDF.
| Date | Firm | Scope | Findings | Status | Report |
|---|---|---|---|---|---|
| 2026-07-14 | Trail of Bits | SwapRouter v2.1, GasSponsor contract, FeeOracle | 0 Critical 1 Medium 3 Low | Resolved | PDF ↓ |
| 2026-03-28 | Halborn | SwapRouter v2.0, LiquidityPool, GasReserve | 0 Critical 0 High 2 Medium 5 Low | Resolved | PDF ↓ |
| 2025-11-10 | SlowMist | AtomicSwap v1.0, TRC-20 adapter, event logger | 0 Critical 1 High 3 Medium 7 Low | Resolved | PDF ↓ |
| 2025-08-02 | CertiK | Initial contract suite: SwapRouter v1.0, FeeModule | 0 Critical 0 High 1 Medium 4 Low | Resolved | PDF ↓ |
Findings Summary
Aggregate findings across all four audit engagements. Every issue classified as High or above has been remediated and confirmed by the auditing firm. No critical vulnerabilities have ever been identified in a Velox production contract.
Critical
No vulnerability that would allow direct loss of user funds, unauthorized contract upgrades, or bypass of access controls has ever been found.
Clean RecordHigh
Identified in the SlowMist audit (Nov 2025): a potential reentrancy vector in the TRC-20 adapter. Remediated within 72 hours and confirmed by SlowMist before the subsequent deployment.
RemediatedMedium
Primarily gas optimization opportunities, event emission ordering, and edge-case rounding in fee calculations. All addressed and confirmed during follow-up reviews.
All ResolvedLow / Informational
Code-style recommendations, NatSpec documentation improvements, and minor gas optimizations. Three informational items are acknowledged and tracked for the next major release.
3 AcknowledgedAudit Methodology
Each audit engagement follows a standardized process aligned with industry best practices. Every firm receives the complete source code, deployment scripts, test suite, and architectural documentation before commencing review.
Static Analysis & Manual Review
Line-by-line review of every Solidity contract by two independent senior auditors. Automated scanners (Slither, Mythril) run as a pre-filter; every flagged item is manually triaged.
Dynamic Testing & Fuzzing
Contracts are deployed to a TRON testnet fork and exercised with Echidna and custom fuzzing harnesses. Invariant tests verify that gas sponsorship cannot be drained, swap rates cannot be manipulated, and funds always settle to the intended recipient.
Remediation & Confirmation
Velox engineers address each finding and submit a diff to the auditor. The auditor confirms the fix, re-runs targeted tests, and issues a verification letter before the contract proceeds to deployment.
On-Chain Verification
Deployed contract source code is verified on TronScan so anyone can confirm the bytecode matches the audited source. Contract addresses and verification links are published alongside each report.