> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blend.money/llms.txt
> Use this file to discover all available pages before exploring further.

# Audits

> Every audit Blend has completed. All reports are public and available on GitHub.

Blend's smart contracts have been audited **11 times** by **3 independent firms**: Cantina, Sherlock, and Zellic. Every report is public. **Zero critical or high-severity issues** have ever been found.

All reports are available at [github.com/blendmoney/audits](https://github.com/blendmoney/audits).

## Cross-Chain Adapters & Withdraw Security Review

**Sherlock** | June 10-12, 2026 | Auditors: deth, montecristo

Reviewed Blend's cross-chain adapter infrastructure and user withdraw flow, covering `AcrossXChainAdapter.sol`, `CCTPXChainAdapter.sol`, `OFTXChainAdapter.sol`, `UserWithdrawVaultAction.sol`, `XChainVaultAction.sol`, `IXChainAdapterController.sol`, `DeallocateLib.sol`, `PriceLib.sol`, and `UserWithdrawController.sol`.

| Severity        | Count     |
| --------------- | --------- |
| Critical / High | **0**     |
| Medium          | 1 (fixed) |
| Low / Info      | 1 (fixed) |

<Accordion title="Key fixes">
  * Drain-mode cross-chain sweeps no longer revert when adapters refund sub-decimal dust after bridging
  * `AcrossXChainAdapter` now rejects expired or near-expired fill deadlines before depositing
</Accordion>

[View report (PDF) →](https://github.com/BlendMoney/audits/blob/main/blend-26-06-12-0.sherlock.pdf)

## User Withdraw Controller Security Review

**Sherlock** | April 29 - May 1, 2026 | Auditors: oot2k, thekmj

Reviewed Blend's user withdraw controller, delegate controller, and supporting libraries, covering `UserWithdrawController.sol`, `DelegateController.sol`, `MorphoVaultLib.sol`, `PriceLib.sol`, `StrategyManager.sol`, `RebalanceTypes.sol`, and `StrategyTypes.sol`.

| Severity                       | Count |
| ------------------------------ | ----- |
| Critical / High / Medium / Low | **0** |

[View report (PDF) →](https://github.com/BlendMoney/audits/blob/main/blend-26-05-04-0.sherlock.pdf)

## Cross-Chain Infrastructure Security Review

**Sherlock** | March 3-5, 2026 | Auditors: oot2k, thekmj

Reviewed Blend's cross-chain infrastructure updates covering `AcrossXChainAdapter.sol`, `CCTPXChainAdapter.sol`, `XChainVaultAction.sol`, `BlendSafeFactory.sol`, `MorphoVaultLib.sol`, and `PriceLib.sol`.

| Severity                 | Count                       |
| ------------------------ | --------------------------- |
| Critical / High / Medium | **0**                       |
| Low / Info               | 5 (3 fixed, 2 acknowledged) |

<Accordion title="Key fixes and acknowledgements">
  * Finality threshold assumptions documented for `CCTPXChainAdapter`
  * Executor-controlled slippage assumptions explicitly acknowledged in cross-chain execution
  * Pragma consistency improvements across cross-chain modules
  * Adapter dust invariant documented as an intentional trade-off
  * Removed unnecessary `PriceLib.normalize()` cleanup path
</Accordion>

[View report (PDF) →](https://github.com/BlendMoney/audits/blob/main/blend-26-03-10-0.sherlock.pdf)

## Ostium Integration and Bundler3 Compatibility

**Sherlock** | January 12-15, 2026 | Auditors: eeyore, montecristo

Reviewed Blend's integration with Ostium perpetual trading and Morpho Bundler3 adapter compatibility. Covered vault controllers, swap adapters, cross-vault actions, perpetual position management, and oracle fee mechanics.

| Severity        | Count      |
| --------------- | ---------- |
| Critical / High | **0**      |
| Medium          | 2 (fixed)  |
| Low / Info      | 17 (fixed) |

<Accordion title="Key fixes">
  * Rebalance validation for oracle fees and freed capital during position adjustments
  * Pending order management to prevent multiple positions at different indexes
  * Rebasing token support (stETH) in `SwapAdapter`
  * Improved balance calculations using `maxWithdraw`
  * Full `@custom:reverts` tags across all adapter contracts
</Accordion>

[View report (PDF) →](https://github.com/BlendMoney/audits/blob/main/blend-26-01-22-0-sherlock.pdf)

## Swap Adapter Security Review

**Sherlock** | November 27-28, 2025 | Auditor: PUSHO

Focused on `SwapAdapter.sol` and `PriceLib.sol`. Added `sweepToken` function for recovering intermediate tokens stuck in multi-hop swaps, and corrected misleading code comments.

| Severity                 | Count     |
| ------------------------ | --------- |
| Critical / High / Medium | **0**     |
| Low / Info               | 2 (fixed) |

[View report (PDF) →](https://github.com/BlendMoney/audits/blob/main/blend-25-12-05-0-sherlock.pdf)

## Rate Limiting Enhancement

**Cantina** | October 10, 2025 | Auditor: Sujith Somraaj

Reviewed rate limiting in the Strategy Manager contract. Fixed an off-by-one error, added visibility identifiers, removed `virtual` keyword to prevent rate limit bypass in derived contracts, and added constructor validation.

| Severity                       | Count     |
| ------------------------------ | --------- |
| Critical / High / Medium / Low | **0**     |
| Info                           | 4 (fixed) |

[View report (PDF) →](https://github.com/BlendMoney/audits/blob/main/blend-25-10-10-0-cantinacode.pdf)

## Swap Adapter Enhancement

**Cantina** | October 5, 2025 | Auditor: Sujith Somraaj

Reviewed multi-hop swap functionality. Added output amounts to `SwapExecuted` events, switched `strategyData` to `calldata` for gas savings, added slippage and zero-address validation.

| Severity                 | Count     |
| ------------------------ | --------- |
| Critical / High / Medium | **0**     |
| Low                      | 2 (fixed) |
| Info                     | 4 (fixed) |

<Accordion title="Key fixes">
  * Added actual output amount to `SwapExecuted` event for better off-chain monitoring
  * Changed `strategyData` parameter from `memory` to `calldata` for reduced gas costs
  * Added upper bound validation for `maxSlippageBps` and zero address checks
  * Dust handling in multi-hop swaps acknowledged as intentional gas-efficiency trade-off
</Accordion>

[View report (PDF) →](https://github.com/BlendMoney/audits/blob/main/blend-25-10-05-0-cantinacode.pdf)

## Swap Adapter Security Assessment

**Zellic** | October 2, 2025

Assessed `WhitelistedSwapAdapter` and `SwapAdapter` contracts, focusing on temporal access control (rebalance and vault action phases). Single informational finding about constructor validation was fixed.

| Severity                       | Count     |
| ------------------------------ | --------- |
| Critical / High / Medium / Low | **0**     |
| Info                           | 1 (fixed) |

[View report (PDF) →](https://github.com/BlendMoney/audits/blob/main/blend-25-10-02-0-zellic.pdf)

## Cross-Chain Adapter Audit

**Cantina** | September 29, 2025 | Auditor: Rvierdiiev

Reviewed `AcrossXChainAdapter` and `SwapAdapter` contracts. Fixed unnecessary external call for gas savings. Griefing risks mitigated via private execution environment. Slippage methodology validated.

| Severity                 | Count         |
| ------------------------ | ------------- |
| Critical / High / Medium | **0**         |
| Info                     | 3 (mitigated) |
| Gas optimization         | 1 (fixed)     |

[View report (PDF) →](https://github.com/BlendMoney/audits/blob/main/blend-25-09-29-1-cantinacode.pdf)

## Code Improvements Audit

**Cantina** | September 29, 2025 | Auditor: Sujith Somraaj

Reviewed Intent Engine contract improvements. Removed redundant checks, optimized loop structures, cached `WRAPPED_NATIVE()` calls, increased test coverage, and added share-price validation.

| Severity                       | Count     |
| ------------------------------ | --------- |
| Critical / High / Medium / Low | **0**     |
| Info                           | 5 (fixed) |

[View report (PDF) →](https://github.com/BlendMoney/audits/blob/main/blend-25-09-29-0-cantinacode.pdf)

## Initial Code Audit

**Cantina** | August 10, 2025

Full review of Blend's core protocol contracts. Evaluated architecture, smart contract security, slippage controls, rebalance validation, and griefing vectors. Mature, well-maintained codebase with all issues promptly resolved.

| Severity        | Count     |
| --------------- | --------- |
| Critical / High | **0**     |
| Medium          | All fixed |

[View report (PDF) →](https://github.com/BlendMoney/audits/blob/main/blend-25-08-10-0-cantinacode.pdf)

## Audit Firms

<CardGroup cols={2}>
  <Card title="Cantina" icon="shield-halved" href="https://cantina.xyz">
    5 audits. Leading smart contract security firm with deep DeFi expertise.
  </Card>

  <Card title="Sherlock" icon="shield-halved" href="https://sherlock.xyz">
    5 audits. Decentralized audit marketplace with bug bounty coverage.
  </Card>

  <Card title="Zellic" icon="shield-halved" href="https://zellic.io">
    1 audit. Blockchain security firm specializing in protocol assessments.
  </Card>
</CardGroup>

<Note>
  If you discover a potential vulnerability, please report it to [hello@blend.money](mailto:hello@blend.money). We take all reports seriously and will respond promptly.
</Note>