> For the complete documentation index, see [llms.txt](https://doc.tapir.money/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.tapir.money/security/security-and-audits.md). # Security & Audits Published Quantstamp and Hashlock audits, source verification, and security reporting. Tapir Core V1 has been reviewed by **Quantstamp** and **Hashlock**. The reports cover specific source versions and scopes; they do not guarantee the safety of every deployment, underlying vault, or integration. ## Understand the risks | Exposure | What it can mean for your position | Read more | | -------------------- | --------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DP protection limits | A qualifying loss increases the base-asset claim, but the cap, entry premium, fees, and system risks can still leave a loss | [DP](/protocol-mechanics/tapir-mechanics/depeg-risks-splitting/dp.md) | | YB and LP exposure | YB can redeem for zero; an LP’s changing inventory can concentrate in that losing side | [YB](/protocol-mechanics/tapir-mechanics/depeg-risks-splitting/yb.md), [Liquidity](/system-workflow/liquidity.md#risks) | | Underlying protocol | Strategy losses, valuation issues, or withdrawal restrictions can affect the asset backing the pool | [Risk Analyses](/security/vault-risk-reports.md) | | Exits and settlement | Liquidity limits, pauses, and settlement waits can delay an exit; redemption returns the pool’s base asset | [Exit & Redeem](/system-workflow/redeem.md) | | Oracles and controls | Incorrect data or operator/admin actions can affect settlement; contracts and dependencies can fail | [Oracle Resolution](/protocol-mechanics/tapir-mechanics/oracle-resolution.md), [control details](/resources/tapir-faq/complete-version.md#who-controls-the-current-contracts) | ## Integrated-protocol risk analyses The [Risk Analyses](/security/vault-risk-reports.md) directory contains a report for each integrated protocol. Use it alongside the relevant pool page. Audit evidence for Tapir’s contracts is collected below. ## Published audits The auditor-hosted versions are canonical. Downloadable copies are included here so the reports remain accessible alongside these docs. | Auditor | Official publication | Download | Scope and version | | -------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | **Quantstamp** | [Verified Security Certificate](https://certificate.quantstamp.com/full/tapir-protocol/f96d902f-85a1-4310-92e8-fcac6fa48f07/index.html) | [Download below](#download-report-copies) | December 2025 review of the core baseline and the separate Tapir AMM repository. The core baseline is `4ec27b5`; the AMM baseline is `ff4d820`. | | **Hashlock** | [Final Report v2](https://hashlock.com/wp-content/uploads/2026/08/Tapir-Money-Review-Smart-Contract-Audit-Report-Final-Report-v2.pdf) | [Download below](#download-report-copies) | Seven core contracts, including the VRP oracle. The report pins initial review `e951edc3` and fix review `9fc06de7`. | **The VRP oracle was added after Quantstamp's core baseline and was reviewed by Hashlock.** It is not covered by Quantstamp's earlier file manifest. Hashlock's scope comprises `DepegFactory`, `DepegPool`, `TapirOracle`, `TapirPtrwOracle`, `TapirRouter`, `TapirVrpOracle`, and `TimeDecay`; it does not include the separate AMM implementation or external dependencies. ## Download report copies {% file src="/files/mvnZT8yWcTZg2lsVEGw5" %} Quantstamp final report {% endfile %} {% file src="/files/UwN0a9AQf05PUgyDSzFU" %} Hashlock Final Report v2 {% endfile %} ## Relating the audits to the source The [Tapir Core V1 repository](https://github.com/tapir-protocol/public-tapir-core-v1) contains the reports, contract source, technical specifications, and an [audit verification guide](https://github.com/tapir-protocol/public-tapir-core-v1/blob/main/VERIFICATION.md). The separate [Tapir Markets repository](https://github.com/tapir-protocol/public-tmarket-univ3-based) contains the DP/YB AMM and its own [Quantstamp verification guide](https://github.com/tapir-protocol/public-tmarket-univ3-based/blob/main/VERIFICATION.md). Both repositories are public. The verification guide reconstructs the commits named in the reports and compares the `contracts/` Git tree. The current release matches Hashlock's **fix-review** source, not the earlier Quantstamp or initial Hashlock source. Matching a source tree establishes which code was reviewed; deployed addresses and bytecode must be checked separately. See [Source Code & Contracts](/resources/source-code-and-contracts.md). The Hashlock PDF downloaded from the auditor on **2026-09-08** matches the copy in the core repository and the download above. Its SHA-256 is: ``` 35c1471d946744562cc966117611b73349d15bba9ca750365b5197f16e783029 ``` The auditor may publish a revised file at the same URL. A different checksum would require comparing versions. ## Reporting a vulnerability Follow the repository's [Security Policy](https://github.com/tapir-protocol/public-tapir-core-v1/blob/main/SECURITY.md): use GitHub's private vulnerability reporting under **Security → Report a vulnerability**, when available to you. Include the affected contract and function, impact, and reproduction steps or a proof of concept. If repository access or private reporting is unavailable, contact [Tapir's official account](https://x.com/Tapir_Protocol) privately to request a security contact. Do not post vulnerability details in public issues, social posts, or the community Telegram group. A public bug bounty program has not been announced on this page. Reporting an issue does not establish eligibility for a reward. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://doc.tapir.money/security/security-and-audits.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.