Audit recency

Methodology how we score #

**What this measures** This factor records the number of days between the most recent audit report sign-off date and the current assessment date, measured over the currently deployed bytecode. If the protocol has deployed code changes since the audit, the clock resets to zero coverage for that surface and the factor is assessed relative to the most recent audit that covers the live code. The data source is audit PDF metadata combined with on-chain deploy timestamps.

**Why it matters** Code that was reviewed two or more years ago was reviewed against the vulnerability knowledge of that era. The Onyx Protocol's second exploit (September 2024) came 32 months after a January 2022 CertiK audit -- the longest audit-to-exploit gap for an 'audited' protocol in the dataset -- and crucially, the empty-market attack pattern exploited had only been publicly documented after the audit was completed. Audit recency is not a guarantee of safety, but a stale audit is a leading indicator that the protocol's code has drifted beyond what the security review covered, particularly for fast-moving ecosystems where new vulnerability classes emerge regularly.

**Green / Yellow / Red** Green: the most recent audit covering the deployed bytecode was completed within 12 months and no code changes have been deployed since. Yellow: the audit is 12 to 24 months old, or code changes have been deployed since the audit with a delta-review covering the changes. Red: the most recent audit is older than 24 months, or deployed code has changed substantially since the last audit with no subsequent review of any kind.

**Common gray cases** Curators cannot grade this factor when no audit report with a clear sign-off date is publicly available, or when the protocol refuses to disclose audit metadata.

**Notable historical examples** - **Atomic Wallet** ($100M est., 2023): Least Authority findings from a 2021 audit were never addressed; the audit was approximately two years stale at exploit time. - **Onyx Protocol 2nd** ($3.8M, 2024): CertiK audit from January 2022 was 32 months stale; the exploited empty-market pattern was not known at audit time. - **GMX V1** ($42M recovered, 2025): Approximately three years of post-audit code changes had accumulated before the exploit. - **Yearn Finance** ($10M, 2023): Exploit occurred approximately three years after a February 2020 audit. - **Venus Protocol** ($3.7M, 2026): Code4rena audit that had flagged the exact vulnerability class was approximately three years old at exploit time.

Measurement what to look for #

Measure the number of days between today and the sign-off date of the most recent audit report covering the currently-deployed bytecode.

Data & output #

Scored protocols 80 carry this factor #

Linked hacks 9 historical incidents #