Skip to content
QuantillonSecurity
Navigation menu
Open app

Security

Security you can check.

Quantillon Protocol has not been audited by an external security firm. Until it is, the contracts go through an internal, AI-assisted security review every two months, plus a review on every release. Each review is recorded here with its scope, its limits, its disclosed findings, and how they were resolved.

Read the review logReport a vulnerability
Last disclosed review
30 Sep 2026No. 4 · 2026-09-30
Next review due by
1 Dec 2026Every 2 months · every release
Live core contracts matching a reviewed build
9 / 12see Coverage
Third-party audit
None yetreviews here are internal

Plainly

What this is, and what it is not

An internal review is worth exactly what can be verified about it. So this page says what is done, what is not, and how to check.

What it is

  • A recurring review of the contract source and of what is actually deployed, run with frontier AI models under a fixed, versioned method. The models and review tools used are named in every published review.
  • Evidence-based. Findings are reproduced with tests wherever possible, and each one is graded by how strongly it was verified.
  • Accountable. Resolved findings are published with their severity, affected component, remediation, and disclosure date.

What it is not

  • Not independent. The team that writes the code runs the review.
  • Not a guarantee. A review can miss issues, and AI-assisted review has blind spots of its own.
  • Not a substitute for a third-party audit, which remains the goal.

Process

From review to disclosure

  1. Review

    A full review every two months, and a differential review of every release before it is deployed.

  2. Validate

    Suspected issues are reproduced where possible, then each fix is reviewed before deployment.

  3. Fix

    Findings are fixed, the fix is itself reviewed, and the upgrade goes through the protocol’s governance.

  4. Disclose

    Once a fix is live, the finding is listed with its severity, a one-line summary and the version that resolved it.

Latest

Most recent review

Standing controls

What holds between reviews

Each statement links to where it can be checked.

  • No third-party audit yet

    No external security firm has audited Quantillon Protocol. Every review recorded on this site is internal and AI-assisted. It is carried out by the team that writes the code, and it is not independent.

  • Public, verifiable source

    The contract source is public, and every core contract reports its semantic version through version(). Deployment manifests record implementation addresses, versions and source commits, but can lag later upgrades. Read on-chain versions and active bindings to establish current state.

    Check it: Source repository · Deployment records (Base) · Verified production reference

  • Automated tests and release gates

    Tests run for relevant pushes and pull requests, and on scheduled or manually dispatched runs. Push and pull-request gates check contract size, storage compatibility, ABI compatibility and version bumps. Slither static analysis runs in the heavier nightly or manually dispatched workflow; it is not part of every push.

    Check it: CI runs · Workflow definition

Trust assumptions and known limitations

Responsible disclosure

Found something? Tell us first.

Write to team@quantillon.money before any public disclosure. We validate the report with you, fix the issue, and coordinate publication once the fix is live.

Disclosure policy