> For the complete documentation index, see [llms.txt](https://docs.tapir.money/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tapir.money/security/security-and-audits.md).

# Security & Audits

Published Quantstamp and Hashlock audits, source verification, and security reporting.

Tapir Core V1 has been reviewed by **Quantstamp** and **Hashlock**. The reports cover specific source versions and scopes; they do not guarantee the safety of every deployment, underlying vault, or integration.

## Understand the risks

| Exposure             | What it can mean for your position                                                                                          | Read more                                                                                                                                                                     |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DP protection limits | A qualifying loss increases the base-asset claim, but the cap, entry premium, fees, and system risks can still leave a loss | [DP](/protocol-mechanics/tapir-mechanics/depeg-risks-splitting/dp.md)                                                                                                         |
| YB and LP exposure   | YB can redeem for zero; an LP’s changing inventory can concentrate in that losing side                                      | [YB](/protocol-mechanics/tapir-mechanics/depeg-risks-splitting/yb.md), [Liquidity](/system-workflow/liquidity.md#risks)                                                       |
| Underlying protocol  | Strategy losses, valuation issues, or withdrawal restrictions can affect the asset backing the pool                         | [Risk Analyses](/security/vault-risk-reports.md)                                                                                                                              |
| Exits and settlement | Liquidity limits, pauses, and settlement waits can delay an exit; redemption returns the pool’s base asset                  | [Exit & Redeem](/system-workflow/redeem.md)                                                                                                                                   |
| Oracles and controls | Incorrect data or operator/admin actions can affect settlement; contracts and dependencies can fail                         | [Oracle Resolution](/protocol-mechanics/tapir-mechanics/oracle-resolution.md), [control details](/resources/tapir-faq/complete-version.md#who-controls-the-current-contracts) |

## Integrated-protocol risk analyses

The [Risk Analyses](/security/vault-risk-reports.md) directory contains a report for each integrated protocol. Use it alongside the relevant pool page. Audit evidence for Tapir’s contracts is collected below.

## Published audits

The auditor-hosted versions are canonical. Downloadable copies are included here so the reports remain accessible alongside these docs.

| Auditor        | Official publication                                                                                                                    | Download                                  | Scope and version                                                                                                                               |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| **Quantstamp** | [Verified Security Certificate](https://certificate.quantstamp.com/full/tapir-protocol/f96d902f-85a1-4310-92e8-fcac6fa48f07/index.html) | [Download below](#download-report-copies) | December 2025 review of the core baseline and the separate Tapir AMM repository. The core baseline is `4ec27b5`; the AMM baseline is `ff4d820`. |
| **Hashlock**   | [Final Report v2](https://hashlock.com/wp-content/uploads/2026/08/Tapir-Money-Review-Smart-Contract-Audit-Report-Final-Report-v2.pdf)   | [Download below](#download-report-copies) | Seven core contracts, including the VRP oracle. The report pins initial review `e951edc3` and fix review `9fc06de7`.                            |

**The VRP oracle was added after Quantstamp's core baseline and was reviewed by Hashlock.** It is not covered by Quantstamp's earlier file manifest. Hashlock's scope comprises `DepegFactory`, `DepegPool`, `TapirOracle`, `TapirPtrwOracle`, `TapirRouter`, `TapirVrpOracle`, and `TimeDecay`; it does not include the separate AMM implementation or external dependencies.

## Download report copies

{% file src="/files/JUzSjpoJWFqOL7A73Z6y" %}
Quantstamp final report
{% endfile %}

{% file src="/files/diUdLOoQYIjOtPt02HNv" %}
Hashlock Final Report v2
{% endfile %}

## Relating the audits to the source

The [Tapir Core V1 repository](https://github.com/tapir-protocol/public-tapir-core-v1) contains the reports, contract source, technical specifications, and an [audit verification guide](https://github.com/tapir-protocol/public-tapir-core-v1/blob/main/VERIFICATION.md). The separate [Tapir Markets repository](https://github.com/tapir-protocol/public-tmarket-univ3-based) contains the DP/YB AMM and its own [Quantstamp verification guide](https://github.com/tapir-protocol/public-tmarket-univ3-based/blob/main/VERIFICATION.md). Both repositories are public.

The verification guide reconstructs the commits named in the reports and compares the `contracts/` Git tree. The current release matches Hashlock's **fix-review** source, not the earlier Quantstamp or initial Hashlock source. Matching a source tree establishes which code was reviewed; deployed addresses and bytecode must be checked separately. See [Source Code & Contracts](/resources/source-code-and-contracts.md).

The Hashlock PDF downloaded from the auditor on **2026-09-08** matches the copy in the core repository and the download above. Its SHA-256 is:

```
35c1471d946744562cc966117611b73349d15bba9ca750365b5197f16e783029
```

The auditor may publish a revised file at the same URL. A different checksum would require comparing versions.

## Reporting a vulnerability

Follow the repository's [Security Policy](https://github.com/tapir-protocol/public-tapir-core-v1/blob/main/SECURITY.md): use GitHub's private vulnerability reporting under **Security → Report a vulnerability**, when available to you. Include the affected contract and function, impact, and reproduction steps or a proof of concept.

If repository access or private reporting is unavailable, contact [Tapir's official account](https://x.com/Tapir_Protocol) privately to request a security contact. Do not post vulnerability details in public issues, social posts, or the community Telegram group.

A public bug bounty program has not been announced on this page. Reporting an issue does not establish eligibility for a reward.