Audits
The contracts have been reviewed three times by parties independent of the development team. All three reports are published in full on the dashboard.
Zenith — version 1.1, audited 24–25 August 2026, published 27 August 2026.
Scope: unit-core, src/**/*.sol, with a separate review of the fixes.
| Severity | Count |
|---|---|
| Critical | 0 |
| High | 1 |
| Medium | 3 |
| Low | 7 |
| Informational | 6 |
The high finding (two-token JustLend reward claims reverting on a native-TRX callback) was resolved, as were all three medium findings. The output floors on mint and redeem exist because this review asked for them.
T1MOH — independent review of the minter, the staking vault and the custody adapter. Version 1.0, August 2026.
Hashlock — review of the Unit Technologies contracts, published on the auditor's own site.
An audit reviews a specific commit at a specific time. It is not a guarantee.
What the protocol can do to your balance
Stated plainly, because it is the trust you are extending:
- The token and the vault have no freeze and no confiscation. Nobody can block an address or move a balance out of a wallet without its holder's signature.
- The Minter can be paused. While it is paused, minting and redemption stop; UNIT already in your wallet keeps transferring normally.
- The Minter exposes
withdrawandexecuteCallunder an admin role.executeCallcan make the Minter perform an arbitrary call — it is the most powerful function in the system. - Redemption needs a signature from the protocol. If the signer refuses or is offline, UNIT cannot be redeemed through the Minter.
Two things constrain this. Every use is a public on-chain event and cannot be done quietly. And the power sits under an admin role, separate from the signer and operator keys that run day-to-day operations.
Key separation
The signing key and the operating key are separate. A signature authorises an operation but cannot move funds; the operator can move reserves but cannot produce a valid authorisation. Compromise of either alone is materially less damaging than one key holding both.
GET /health reports which wallets currently hold those roles — roles can be
re-granted on a redeploy, so it is the authority rather than any published list.
Reporting something
If you find a vulnerability, use the support link in the app footer or write to @unitdefisupport on Telegram rather than disclosing it publicly.
For the full risk treatment — reserve venue risk, redemption liquidity, peg transmission, service liveness — read the whitepaper.