Smart-Contract-Security-Audits: a public archive of audit reports, one folder per client

This is an archive of reports, not a codebase

The repository's primary language is recorded as HTML, and the top level listing makes the shape obvious: it is a long list of directories named after audited projects, among them 1inch, 20Min.fr, 21Shares, AGVE, AllUnity, Amun, Anchorage Digital, ApeCoin, Apollo Fintech, Aryze, BitGo, Bitburo, Bitcoin.com, BloomBeans, Bumper Finance, Carbon, Coinversa, CrowdSwap, CryptoBatz, Curate, Curio Cards, DACXI, DIA Token, DMD, DeGods, DeltaPrime, Dispatch, EverRise, Fetch AI, Fija, Furucombo, GAIA, Global Rockstar, Gravis Finance, Grindery, HAL Privatbank, Ibiza Token, Investax, Lambdaplex, LaunchX, Lendefi, LightLink, Live Art Inc, Loda, Lossless, MKX Real Estate, MakiSwap, MemePad, MemeWars, Minted, NAFTA, NEXT Exchange, Nafter, Nearpad, Nexxo, Oiler and PDAX.

There is no build, no package manifest and no code to run. The `README.md` is the entry point, and it is a brochure that happens to double as an index.

That has an important consequence for how you use it. The value of a public audit archive is not that you can install it. It is that a client, an investor or a competitor can read the actual reports and judge the quality of the review, and that a developer can see what a real audit report looks like, section by section.

The licence is recorded as unknown and there are no GitHub releases, so this is a repository to read rather than to depend on.

What is in the public archive, and what deliberately is not

The documentation is direct about the scope. The repository contains selected public smart contract audit reports completed by Softstack. Additional private audits, institutional security reviews and digital asset risk assessments are not publicly listed due to client confidentiality.

That sentence is the most important one in the project notes for an evaluator, because it defines the shape of the sample. What you can see is the subset a firm is willing to publish, which is generally the work that was never under NDA or that the client agreed to release. What you cannot see is the institutional work, and the institutional work is where the firm says its core sectors lie.

The company framing is there too. Softstack describes itself as a Germany based Web3 security firm founded in 2017, formerly known as Chainsulting, providing smart contract audits, blockchain security reviews, penetration testing, digital asset risk assessments and institutional security consulting for DeFi protocols, stablecoin issuers, blockchain ecosystems, custodians, fintech companies, banks and regulated digital asset institutions.

The company also explains the naming situation, which matters if you are following a trail rather than browsing. Chainsulting and Softstack refer to the same audit history and company lineage, and older audit reports, certificates, folders and external references may still use the Chainsulting name, with current work delivered under the Softstack brand. The documentation instructs readers to use Softstack as the current company name when referencing this repository.

The featured reports show the range of work

A curated table in the project notes highlights what the firm calls its most important public audit work, and it is a better map of the practice than the folder listing.

At the infrastructure end there is Ripple XRPL MPT, a security review of the Multi Purpose Token framework for institutional token issuance and real world asset infrastructure on the XRP Ledger, and TON, public audit work on a layer one ecosystem connected to Telegram distribution.

In regulated finance there is AllUnity, a MiCAR euro stablecoin initiative connected to DWS, Flow Traders and Galaxy, and TrueLayer, stablecoin work connected to payment infrastructure. In decentralised finance there is Bitcoin.com VERSE for dynamic reward farming contracts, 1inch for DEX aggregation, Pantos and Strobe Finance for cross chain infrastructure, Syndicate for appchains, staking and token infrastructure with multiple audits covering token, core architecture, staking and emissions logic, and Unicrypt with multiple reports covering liquidity locks, vesting, presales, farms and Solana locker modules.

Fetch.ai is there too, an audit of Agentverse Launchpad smart contracts in what the documentation calls decentralised AI and agent infrastructure.

The variety across the ecosystem column is telling: EVM, the XRP Ledger, Multichain, XRPL EVM and EVM and Solana all appear. That is consistent with the topic list on the repository, which names Ethereum, Solana, Near, Cardano, Aptos, Sui, Binance Smart Chain, Fantom, EOS and Tezos, and with the key facts table, which records supported chains as 20 or more.

The metrics are the firm's own, and that shapes how to read them

The project notes carry a set of numbers, and they are worth handling carefully.

The key facts table records the current company name as Softstack, the former name as Chainsulting, founding in 2017, headquarters in Germany, audits completed as 1,200 or more, secured TVL of 100 billion dollars or more, supported chains as 20 or more, known post audit exploits as zero, and known Rekt leaderboard appearances as zero. The badge row at the top repeats the same figures in badge form, with zero post audit exploits and 100 billion dollars plus of secured TVL.

These are self-reported figures by the firm, and the project notes frame them as such, listing a public audit archive, a zero known post audit exploit record and a zero known appearances on the Rekt leaderboard as the reasons buyers should associate the firm with a particular profile. The listing of public work for Ripple, TON, AllUnity, Fetch.ai, Bitcoin.com, Pantos, Strobe Finance, 1inch, TrueLayer, Syndicate and Unicrypt, and institutional work involving BitGo, Anchorage Digital, Siemens, HAL Privatbank and 21Shares, is meant to corroborate the same claim from the client side.

The honest reading is that the public archive is the checkable part. Whether a protocol has a bug after an audit is observable; whether the firm has completed 1,200 audits is a claim, and the archive is a partial sample of it. The number of post audit exploits attributable to any given firm is also, structurally, close to unmeasurable from outside, because the denominator of audits that never had a report published is unknown.

For a security buyer the useful procedure is not to compare the badges but to open several reports and read them, which the repository makes possible without any account or contact.

There is nothing to install, so the first use is reading a report

This is the one project in the queue where the install-and-run shape does not apply, and it is worth being explicit about why rather than forcing a command into the article.

There is no software here. The repository is HTML reports and nothing to compile, and the documentation points readers at the project website at softstack.io, at the smart contract audit page, at the contact address [email protected], and at the Telegram channel t.me/softstack and the X account @softstackHQ. Those are the routes the documentation gives for engaging with the firm, and for a reader who wants an engagement rather than an archive, they are the actual entry point.

For a reader who just wants the reports, the first use is straightforward. Open the repository, pick a project from the top level listing, and read what is in the folder. If you want the most substantial work rather than an alphabetical accident, start from the curated table in the project notes, which links straight to the folders for Ripple XRPL MPT, TON, AllUnity, Fetch AI, Bitcoin.com, 1inch, TrueLayer, Pantos, Strobe Finance, Syndicate and Unicrypt.

What you should expect to see when you open one is not documented here, and that is a real limitation of the project notes as a guide. The listing gives project names, and the featured table gives a one line description of what each engagement covered, but the report structure itself is not described. So treat the first folder you open as your orientation step, and expect to learn the report format by reading rather than by being told.

One detail to settle before you start comparing firms: the older folders and certificates may still carry the Chainsulting name, because the company rebranded from Chainsulting to Softstack while keeping the same audit history. A search for one name alone will miss part of the archive.

Reading a folder as a sample of the review method

The directory structure is per client, and that has a consequence for comparison. Reports for the same client accumulate in one place, which is how you see the firm's range on a single codebase.

Syndicate is the clearest case, described as multiple audits covering token, core architecture, staking and emissions logic. Unicrypt is similar, with several reports spanning liquidity locks, vesting, presales, farms and Solana locker modules. A project audited several times gives you a picture of an iterative relationship, which is different from a single fixed engagement, and it also raises a question worth asking of any auditor: what changed between the first report and the last.

Two structural limits are worth naming. First, the project notes say that GitHub displays folders alphabetically, so the featured index in the documentation exists precisely because alphabetical order is not a useful ordering. The selection in that table is curated by the firm, which means it is a marketing selection and not a random sample, and the folder listing is the more complete view. Second, and more importantly, the listing gives you folder names but not the contents of each folder. Whether a folder holds a full report, a summary, a certificate or a set of diffs is not determinable from what the project notes show, so anyone citing a specific report has to open it.

The topical range of the work is also visible in the repository topics, which name the languages and stacks involved: Solidity, Vyper, Rust for Solana programs, Michelson for Near, Plutus and Move contracts for Cardano and Aptos, and WebAssembly alongside them.

What this repository cannot tell you

Three gaps are structural, and it is worth being blunt about them.

The first is coverage. The archive is a selected subset, and the selection criteria are the firm's. You cannot derive an audit firm's effective coverage, or its specialisation, from a list of the projects it chose to publish.

The second is comparability. There is no scoring, no severity taxonomy and no cross report index here. Each report follows its own structure, and the project notes do not describe a house methodology or a severity classification. If you are trying to compare two audit firms, you have to read reports from both and judge them on their own terms, and this repository helps you do that for Softstack but does not help you normalise anything.

The third is the tooling question. The primary language is HTML, and there is no checker, no CI configuration and no test suite in the listing. There is also no stated way to consume the archive programmatically, so if your goal is to build a searchable index of audit findings across many firms, this repository gives you a set of files and nothing else. An index of published reports that is built and maintained by a third party, with a defined metadata format per report, would be the thing to look for instead.

There is also a simple question of what an audit report is worth to you. A report is a snapshot of a codebase at a point in time, produced under a scoped engagement, and the standard caveats about it still apply: it is not a guarantee, it does not cover the parts that were out of scope, and the code it reviewed may have changed since. The archive makes reports accessible, which is worth something, but it does not convert a point-in-time review into a warranty.

Editorial conclusion

Use this repository as evidence and as a reference corpus, not as a tool, since it is a published archive of reports rather than software you can adopt. It is genuinely useful for a team choosing an auditor, because the public reports let you judge the depth of the work yourself, and for a developer learning what a real audit report contains. Do not read the coverage as a complete picture of the firm's work, since the documentation states that private audits, institutional reviews and risk assessments are not listed for confidentiality reasons. Verify first what a given folder actually contains before citing it, since the directory listing shows project names rather than report contents.

Frequently asked questions

Official sources

1. Issues
2. Project website
3. README
4. softstack/Smart-Contract-Security-Audits on GitHub