Audits
The Grunt protocol has been reviewed by independent security firms. The full reports are published in the grunt repository and linked below.
| Auditor | Scope | Date | Report |
|---|---|---|---|
| Cantina | Grunt | September 2, 2026 | View ↗ |
| Cantina | Fee Review | May 27, 2026 | View ↗ |
| Cantina | Grunt | May 13, 2026 | View ↗ |
| ChainSecurity | Grunt | April 8, 2026 | View ↗ |
| ChainSecurity | Grunt Funds | April 3, 2026 | View ↗ |
Latest Review
Section titled “Latest Review”Cantina’s September 2026 review is the most recent, and the first to cover the v1.3.0 contracts: the Retargetter with both its flash-loan and Request routes, the offer-based pre-liquidation band and the shared BorrowOffersRegistry, alongside the Facility, Fund, Position Manager, Borrow Position and Request contracts carried over from the earlier scopes.
The review ran from July 20 to July 31, 2026 against commit 9ae1b3cf and reported 43 findings:
| Severity | Found | Fixed | Acknowledged |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 1 | 1 | 0 |
| Low | 17 | 13 | 4 |
| Informational | 25 | 21 | 4 |
| Total | 43 | 35 | 8 |
No critical or high severity issues were found. The single medium severity finding, a liquidation that could leave a positive performance-fee basis while the Position Manager’s NAV fell, was fixed. The reviewed commit precedes the v1.3.0 release, and the reported fixes landed in that release; the eight acknowledged findings are documented with their rationale in the report itself.