Audit recency
Balancer (v2 + v3)'s assessment for RD-F-002 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
v2 (higher-risk): Last audit covering currently-deployed core v2 pool contracts (ComposableStablePool) was Trail of Bits Sept 2022 (~31 months before assessment date 2026-05-05). The 2023-05 Certora FV covered the deprecated TimelockAuthorizer only. v3: Certora comprehensive assessment dated 2026-01-26 (~99 days before assessment). Scoring against v2 = yellow (31 months since last full audit of deployed pool code, well above a 12-month threshold).
Sources #
- GitHubBalancer v2 audit reports directoryhttps://github.com/balancer/balancer-v2-monorepo/tree/master/auditsretrieved 2026-05-05
- Balancer v3 audit reports directoryhttps://github.com/balancer/balancer-v3-monorepo/tree/main/auditsretrieved 2026-05-05
Methodology #
Measure the number of days between today and the sign-off date of the most recent audit report covering the currently-deployed bytecode.
See the full factor methodology and distribution across all protocols →