> For the complete documentation index, see [llms.txt](https://docs.metric.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.metric.xyz/reference/security-and-audits.md). # Security and audits Metric's contracts have been audited five times. The full reports are attached. **Zellic, June 2026.** Smart contract security assessment of the core, periphery and oracle contracts (metric-core 6aa6c3b, metric-periphery 0069084, oracle contracts eda97bb). {% file src="/files/pIoiL99sSYeA45YDmjdi" %} **Zellic, September 2026**. Re-audit of all changes to the core, periphery and oracle contracts since the June review (metric-core 33d0a34 → 4410fec, metric-periphery cc8fef9 → 9b69f75, oracle contracts edbc5f0 → 8b72555). {% file src="/files/Aj2HuD7xB9J0h3OKbxPI" %} **Sherlock, May to June 2026.** Collaborative audit of the core, periphery and oracle contracts (audited at metric-core 6aa6c3b, metric-periphery 90039f9 and oracle contracts a7644f6; fixes at 7b9ab56, d210a84 and 056c204). {% file src="/files/oO7I6HKMDQfyLcVCI6ZL" %} **Sherlock, July 2026.** Public bug bounty audit contest on the core, periphery and oracle contracts (audited at metric-core 7b9ab56, metric-periphery d210a84 and oracle contracts 056c204; fixes at 4410fec, 9b69f75 and 8b72555). {% file src="/files/ozHXCEy5cZtoEz2KurGk" %} **Sherlock, September 2026.** Update review of the periphery contracts, including the external swap executor and the propAMM adapter (metric-periphery, audited at commit 378a748, fixes at ed58520; propamm-adapter, audited at commit 8f127a2, fixes at 652d2a1). {% file src="/files/kt9SJQtxNMgmwc4om8Wc" %} ## Audited code The contracts were developed and audited in private repositories. Every core, periphery and oracle commit named in the reports above is published as a tag in our public repositories, so you can read exactly the code each audit covered: | Repository | Audited commits, published as tags | | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [pool-contracts](https://github.com/Metricxyz/pool-contracts#audited-code) (metric-core) | [`6aa6c3b`](https://github.com/Metricxyz/pool-contracts/tree/audit-6aa6c3b), [`7b9ab56`](https://github.com/Metricxyz/pool-contracts/tree/audit-7b9ab56), [`4410fec`](https://github.com/Metricxyz/pool-contracts/tree/audit-4410fec), plus [`33d0a34`](https://github.com/Metricxyz/pool-contracts/tree/audit-33d0a34), where the Zellic re-audit started | | [periphery-contracts](https://github.com/Metricxyz/periphery-contracts#audited-code) (metric-periphery) | [`0069084`](https://github.com/Metricxyz/periphery-contracts/tree/audit-0069084), [`90039f9`](https://github.com/Metricxyz/periphery-contracts/tree/audit-90039f9), [`d210a84`](https://github.com/Metricxyz/periphery-contracts/tree/audit-d210a84), [`9b69f75`](https://github.com/Metricxyz/periphery-contracts/tree/audit-9b69f75), [`378a748`](https://github.com/Metricxyz/periphery-contracts/tree/audit-378a748), [`ed58520`](https://github.com/Metricxyz/periphery-contracts/tree/audit-ed58520), plus [`cc8fef9`](https://github.com/Metricxyz/periphery-contracts/tree/audit-cc8fef9), where the Zellic re-audit started | | [oracle-contracts](https://github.com/Metricxyz/oracle-contracts/blob/main/docs/README.md#audited-code) (oracle contracts) | [`eda97bb`](https://github.com/Metricxyz/oracle-contracts/tree/audit-eda97bb), [`a7644f6`](https://github.com/Metricxyz/oracle-contracts/tree/audit-a7644f6), [`056c204`](https://github.com/Metricxyz/oracle-contracts/tree/audit-056c204), [`8b72555`](https://github.com/Metricxyz/oracle-contracts/tree/audit-8b72555), plus [`edbc5f0`](https://github.com/Metricxyz/oracle-contracts/tree/audit-edbc5f0), where the Zellic re-audit started | Each tag is named `audit-`, for example `audit-4410fec`. A tag is a new commit without the private history, so its own hash differs from the audited one, but its `contracts/` folder is identical to the audited commit's. The oracle tags also leave out deployment scripts and internal tooling. ### How to verify a tag Each tag includes a `VERIFY.md` and a small script that prove its `contracts/` folder matches the commit hash printed in the audit report. You need only git and Python 3, no access to our private repositories: ```bash git clone --branch audit-4410fec https://github.com/Metricxyz/pool-contracts.git cd pool-contracts python verify/verify.py . ``` The script hashes the audited commit object and its root tree, which are included in the tag, checks that the first matches the hash in the report, and compares the `contracts/` hash listed in that tree with the one in the tag. The last line reads `OK: contracts/ at this tag is identical to contracts/ in audited commit …`. Because a git hash covers every file beneath it, a match proves each contract file is the audited code. Swap in any repository and tag from the table above; each repository's README lists the expected `contracts/` hashes. ## Changes since the last audit The current code in each public repository includes a small number of changes made after its last audit: * **pool-contracts**, since `4410fec`: a fix for precision loss in the bid/ask/reference asymmetry check, and a higher optimizer setting. This version is the core dependency of the periphery code Sherlock reviewed in September 2026. * **periphery-contracts**, since `ed58520`: live quotes from `MetricOmmSwapQuoter` revert with `PoolPaused` for paused pools, and unused code was removed. * **oracle-contracts**, since `8b72555`: a change to how `PriceProvider` and `AnchoredPriceProvider` set their minimum ask, and the new multiplier oracle for tokenized stocks (Base and Robinhood only), which is not covered by the audits above. Everything else changed after these audits is comments, documentation and formatting. Each repository's README lists the details. Found a vulnerability? Write to and get a bounty.