Audits

Gyndore Trust Model

Gyndore builds on proven, open-source infrastructure, keeping changes to the underlying code limited. Its DEX is forked from Uniswap V3, and its stablecoin borrowing system uses established smart contracts. Simple, immutable systems with fewer moving parts and privileged roles leave less to trust and more to verify.

Why it matters

Because the code that ships is the code that runs, security work has to finish before mainnet. There is no patch window and no pause button after deployment. For a borrower, the terms you open on are the terms you close on. For institutions, the core can be modeled once and stays cleared: no upgrade drift, no emergency levers, no governance capture.

Immutability removes discretionary risk, not software risk. That is why independent review sits beside open source in the model, not after launch as an afterthought.

Working with Sherlock

Gyndore chose Sherlock because its security model aligns closely with ours: rigorous review before contracts become immutable, led by researchers selected for demonstrated performance rather than a fixed auditor roster. Sherlock combines collaborative audits with adversarial security contests and has been used by leading DeFi protocols to identify critical vulnerabilities before mainnet deployment. Gyndore's contracts will be reviewed by Sherlock ahead of launch. All findings will be addressed before deployment, with the final audit report published on this page.

Verify the code

You should not have to take Gyndore's security claims on faith. Source for the contracts under review lives on GitHub. Once a deployment is live, the matching addresses are listed on Contracts, so you can compare the verified explorer source to the repository and confirm the bytecode you are interacting with is the one that was reviewed.

Audit reports

This page is the public home for completed reports. Each one will name the scope, the code version reviewed, the findings, and how they were resolved. No reports are published yet, so treat the protocol as unaudited in public until the first one lands. Until then, and after, verify addresses only from Contracts and read the Disclaimer for risks that sit outside the contracts themselves.

Residual risk

An audit is a point-in-time review of a defined scope. A clean report means nothing critical was found in what was examined, not that nothing can go wrong, and not that every dependency around Gyndore was covered. The frontend, your wallet, and third parties Gyndore does not control — including cbBTC, Base, and price feeds — sit outside that scope. Those risks are spelled out in the Disclaimer. After launch, the bug bounty is the private channel for anything new you find.