> For the complete documentation index, see [llms.txt](https://docs.metric.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.metric.xyz/reference/security-and-audits.md).

# Security and audits

Metric's contracts have been audited five times. The full reports are attached.

**Zellic, June 2026.** Smart contract security assessment of the core, periphery and oracle contracts as of June 2026.

{% file src="/files/pIoiL99sSYeA45YDmjdi" %}

**Zellic, September 2026**. Re-audit of all changes to the core, periphery and oracle contracts since the June review (metric-core 33d0a34 → 4410fec, metric-periphery cc8fef9 → 9b69f75, oracle contracts edbc5f0 → 8b72555).

{% file src="/files/Aj2HuD7xB9J0h3OKbxPI" %}

**Sherlock, May to June 2026.** Collaborative audit of the core contracts (metric-core, audited at commit 6aa6c3b, fixes at 7b9ab56).

{% file src="/files/oO7I6HKMDQfyLcVCI6ZL" %}

**Sherlock, July 2026.** Public bug bounty audit contest on the core contracts (metric-core, audited at commit 7b9ab56, fixes at 4410fec).

{% file src="/files/ozHXCEy5cZtoEz2KurGk" %}

**Sherlock, September 2026.** Update review of the periphery contracts, including the external swap executor and the propAMM adapter (metric-periphery, audited at commit 378a748, fixes at ed58520).

{% file src="/files/kt9SJQtxNMgmwc4om8Wc" %}

Found a vulnerability? Write to <security@metric.xyz> and get a bounty.