audited is a date, not a property
every launch announcement has the same line in it somewhere. audited by such and such. and that word does far less work than the people reading it assume, because an audit is not a property of a protocol. it is a receipt for one version of the code on one day.
what it actually is: a scoped review of a named commit. the report says which files and which commit hash were looked at. the thing running on chain may not be that commit. checking whether the deployed bytecode matches what was audited is a real step and almost nobody takes it.
then upgradeability quietly cancels most of the reassurance. if the contracts can be upgraded, the audited code can be replaced with code nobody has looked at, in one transaction, by whoever holds the admin key. audited plus upgradeable is a statement about the past combined with an option on the future, and the option belongs to someone else. so the question is not whether it was audited, it is who can change it and how fast, which is the same question as everywhere else in this industry.
the findings table beats the summary. reports list issues with severities and a resolution status, and that column is where the information lives. fixed is fine. acknowledged means the team read it and chose to live with it, and that happens with high severity items more often than you would like, in plain sight, in a document people cite without opening.
and then the scope, which is where the losses come from. an audit checks whether the code does what the spec says. it does not say the spec is a good idea. oracle assumptions, liquidation parameters, incentive design, governance capture, the economics of using a thin market as a price source: usually listed as out of scope in the report itself. most of the biggest failures were not bugs. the code did exactly what it was written to do, and what it was written to do turned out to be a bad idea at a certain price.
the other exclusion is everything off chain. the front end, the keeper bots, the deployment keys, the signers, the domain registrar. people get robbed through a swapped front end far more often than through a reentrancy bug, and no contract audit covers a website.
what i would rather see than a logo: time live with real value at risk, because nothing substitutes for having been a target and surviving. a bug bounty whose cap is a serious fraction of what is at stake, since fifty thousand on a protocol holding hundreds of millions is a statement about priorities and every whitehat can do that arithmetic. formal verification of the core invariants, narrow but genuinely strong where it applies. published post-mortems, because a team that writes honestly about its own incident is telling you how it will behave in the next one. and an emergency pause, which is a tradeoff rather than a plus: it protects you from bugs and exposes you to whoever holds the button.
reading a report in five minutes: scope section first, files and commit. deploy date against report date. findings table, criticals and highs, resolution column. out of scope section. and whether the review covered the configuration as deployed, because correct code with wrong parameters is the most common way to lose money in something that has been audited twice.
when something does break i keep the protocol token next to the affected pool on my MCMarkets panel rather than watching the token alone, because the first move usually happens in the thinnest venue, and the gap between the two tells you how much of the reaction is forced unwinding and how much is people forming an opinion. those resolve very differently.
none of this is an argument against audits. a protocol that skipped one is worse than a protocol that had one. it is an argument against treating the word as a property, when what it describes is an event: somebody looked at some of this, on a particular tuesday, and wrote down what they found.
not advice, as always. i write about how these systems work, i am not your financial adviser, and none of this is a recommendation on any specific protocol or token.














