> For the complete documentation index, see [llms.txt](https://docs.theo.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.theo.xyz/security-and-transparency/audits.md).

# Audits

List of smart contract audits

Every contract that touches user funds has been reviewed by at least two independent audit firms. Across the four reviews to date, no critical or high severity findings were reported, and every reported finding has been remediated.

| Auditor            | Scope                        | Date     | Findings        | Status     | PDF Link                                                                                                                                         |
| ------------------ | ---------------------------- | -------- | --------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| Zellic             | Mint & Redeem, thUSD, sthUSD | Apr 2026 | 1 low           | Remediated | [Report Link](https://github.com/Zellic/publications/blob/master/ThUSD%20-%20Zellic%20Audit%20Report.pdf)                                        |
| Zenith             | thUSD, sthUSD                | Apr 2026 | 5 low           | Remediated | [Report Link](https://github.com/zenith-security/reports/blob/main/reports/Theo%20Tokenized%20Staking%20Vault%20-%20Zenith%20Audit%20Report.pdf) |
| Pashov Audit Group | Mint & Redeem                | Mar 2026 | 7 low           | Remediated | [Report Link](https://github.com/pashov/audits/blob/master/team/pdf/Theo-security-review_2026-03-19.pdf)                                         |
| Zenith             | thBILL (tToken, iToken)      | Jul 2025 | 8 medium, 3 low | Remediated | [Report Link](https://github.com/zenith-security/reports/blob/main/reports/Theo%20-%20Zenith%20Audit%20Report.pdf)                               |

### Confirming the audited code is the deployed code

An audit only covers the commit it reviewed. In our latest audit, the Zellic team verified and confirmed that the deployed onchain smart contracts are bytecode-matched to the audited commit. This is shown on page 40, section 6 of the Zellic Audit Report from April 2026. 

{% file src="/files/aA4hQxVu2YJha6MTewCi" %}