# Audits

> Third-party security audit reports for the Grunt protocol.

The Grunt protocol has been reviewed by independent security firms. The full reports are published in the [`grunt` repository](https://github.com/3FLabs/grunt/tree/main/audits) and linked below.

| Auditor | Scope | Date | Report |
| --- | --- | --- | --- |
| Cantina | Grunt | September 2, 2026 | [View ↗](https://github.com/3FLabs/grunt/blob/main/audits/Cantina_3F_Grunt_Audit_2026-09.pdf) |
| Cantina | Fee Review | May 27, 2026 | [View ↗](https://github.com/3FLabs/grunt/blob/main/audits/Cantina_3F_Grunt_FeeReview_2026-05-27.pdf) |
| Cantina | Grunt | May 13, 2026 | [View ↗](https://github.com/3FLabs/grunt/blob/main/audits/Cantina_3F_Grunt_Audit_2026-05.pdf) |
| ChainSecurity | Grunt | April 8, 2026 | [View ↗](https://github.com/3FLabs/grunt/blob/main/audits/ChainSecurity_3F_Grunt_Audit_2026-04.pdf) |
| ChainSecurity | Grunt Funds | April 3, 2026 | [View ↗](https://github.com/3FLabs/grunt/blob/main/audits/ChainSecurity_3F_GruntFunds_Audit_2026-04.pdf) |

## Latest Review

Cantina's September 2026 review is the most recent, and the first to cover the v1.3.0 contracts: the [Retargetter](/protocol/retargetter/) with both its flash-loan and Request routes, the offer-based pre-liquidation band and the shared `BorrowOffersRegistry`, alongside the Facility, Fund, Position Manager, Borrow Position and Request contracts carried over from the earlier scopes.

The review ran from July 20 to July 31, 2026 against commit [`9ae1b3cf`](https://github.com/3FLabs/grunt/commit/9ae1b3cf) and reported 43 findings:

| Severity | Found | Fixed | Acknowledged |
| --- | --- | --- | --- |
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 1 | 1 | 0 |
| Low | 17 | 13 | 4 |
| Informational | 25 | 21 | 4 |
| **Total** | **43** | **35** | **8** |

No critical or high severity issues were found. The single medium severity finding, a liquidation that could leave a positive performance-fee basis while the Position Manager's NAV fell, was fixed. The reviewed commit precedes the v1.3.0 release, and the reported fixes landed in that release; the eight acknowledged findings are documented with their rationale in the report itself.