Nexwest has been reviewed by independent security firms across the consensus client, the execution engine, and the bridge contracts. Audit reports are published in full; findings are tracked to remediation.
Engagements
| Firm | Scope | Date | Status |
|---|---|---|---|
| Trail of Bits | Execution engine, margin, liquidation | Q2 2026 | Complete |
| Zellic | Consensus client and networking | Q3 2026 | Complete |
| OtterSec | Bridge and EVM precompiles | Q3 2026 | Complete |
| Spearbit | Portfolio margin and vaults | Q4 2026 | In progress |
What was reviewed
- Order matching and price-time priority.
- Margin, funding, and liquidation formulas.
- Cross-margin and portfolio-margin accounting.
- Vault share issuance, profit share, and withdrawal queues.
- EVM precompiles and the CoreWriter system contract.
- Validator key management and slashing conditions.
Audits are not a guarantee
An audit reduces risk; it does not eliminate it. Read the scope and the open findings before depositing capital. The protocol is upgradable through governance, so code reviewed today can change tomorrow.
Findings
All critical and high findings from completed engagements have been remediated and verified. Medium findings are either fixed or documented as accepted risk. The public tracker lists:
- the finding,
- the severity,
- the affected component,
- the remediation commit,
- the verification status.
Bug bounty
Security researchers can report issues through the bug bounty program. Do not disclose a vulnerability publicly before a fix is deployed.