Acknowledged vs Resolved: Audit Finding Statuses Explained
Quick answer. Resolved means the report marks the issue fixed. Acknowledged means the team accepted the finding with no fix recorded: a design choice, a planned change or an open bug. Guardian's 9,617 public findings are 51.7% resolved, 39.2% acknowledged.
Video transcript
Resolved means the report records a fix. Acknowledged means the team accepted the finding, and no fix is recorded.
Across Guardian's 9,617 public findings, 51.7 percent are resolved and 39.2 percent acknowledged. Most of the rest have no outcome yet. Declined is rare.
Serious findings are fixed more often. Still, 24.9 percent of Criticals and Highs are not marked resolved, and 173 of them are acknowledged.
Most acknowledged findings say nothing more. 90.3 percent give no reason beyond the status itself.
When teams do explain, they say it is by design, a fix is planned, the risk is not yet exposed, or it is documented instead. So acknowledged can mean a sound decision or an open bug.
One Reflex High is marked resolved, yet the team says it was mitigated offchain. On a Peapods Finance Critical, Guardian found the new formula was implemented incorrectly, so the report marks it partially resolved.
For an acknowledged Critical in a protocol you use, ask why it was not fixed and what makes it safe. Check whether the planned fix shipped, whether deployed code matches reviewed code, and what watches it. With no answer, treat it as live.
Read the full guide, browse Guardian's 320 public reports, or ask about Vanguard, which keeps reviewing changes to the audited scope for six months after production.
Every finding in an audit report ends with a status. It is the shortest record of what the team did about the bug.
There is no shared standard for these words. Firms use different labels, and one label can cover very different outcomes.
This guide defines each status in Guardian's reports and shows how often each appears. Then it lists what to ask when a serious finding is not resolved.
Every Status Defined
Guardian's public portfolio data allows eight status values. Each finding has exactly one.
| Status | What it means | Findings |
|---|---|---|
| Resolved | The report records the issue as fixed | 4,974 |
| Partially resolved | A fix landed, but part of the issue remains | 180 |
| Acknowledged | The team accepted the finding; no fix is recorded | 3,772 |
| Pending | No outcome recorded yet | 577 |
| Reported | Raised in a later review round, with no response yet | 104 |
| Declined | The team disputed the finding or rejected the fix | 9 |
| Out of scope | The team ruled the finding outside the audit's scope | 1 |
| Unresolved | Allowed by the data format; no public finding uses it | 0 |
Resolved and acknowledged together cover 90.9% of findings. The rest is mostly findings with no outcome yet.
How Often Each Appears
Status depends heavily on severity. This is every public Guardian finding:
| Severity (findings) | Resolved | Partially resolved | Acknowledged | Pending or reported | Declined or out of scope |
|---|---|---|---|---|---|
| Critical (343) | 84.5% | 3.2% | 7.0% | 5.2% | None |
| High (845) | 71.2% | 4.0% | 17.6% | 7.0% | 0.1% |
| Medium (2,133) | 52.9% | 2.9% | 36.1% | 7.8% | 0.3% |
| Low (4,234) | 49.4% | 1.1% | 43.2% | 6.2% | <0.1% |
| Informational (2,062) | 41.8% | 1.3% | 48.4% | 8.5% | None |
| All (9,617) | 51.7% | 1.9% | 39.2% | 7.1% | 0.1% |
The more serious the finding, the more likely it was fixed. Acknowledged moves the other way, from 7.0% of Criticals to 48.4% of Informational findings.
Still, 296 of 1,188 Criticals and Highs (24.9%) are not marked resolved. 173 of them are acknowledged, across 59 reports.
These figures match our vulnerability remediation rate by severity analysis, which also splits them by category and protocol type.
Resolved and Partially Resolved
Resolved is the outcome you want. Check which commit holds the fix, and whether the auditor reviewed it.
Resolved does not always mean a code change. Reflex H-01, a High, is marked resolved; the team's response says it was acknowledged and mitigated offchain.
The same answer can also carry different statuses. Two Highs in Gamma Strategies' GMX V2 vault report drew one response: liquidation risk would be handled by offchain logic.
One, H-09, is marked resolved. The other, H-04, is partially resolved.
Partially resolved
Partially resolved covers 180 findings, including 11 Criticals and 34 Highs. The auditor's note is the useful part.
On Peapods Finance C-02, a Critical, the team's response says it was resolved in a code change.
Guardian's note says the new formula was implemented incorrectly, causing an underflow that would block all rewards processing. The report marks it partially resolved.
What about "mitigated"?
Guardian's data has no "mitigated" status. A mitigation can be a code change, a parameter, an offchain control or a line of documentation.
Read the response to see which, and ask who keeps it in place.
What Acknowledged Means
Acknowledged is the second most common status: 3,772 findings, or 39.2%. The team accepted the finding, and the report records no fix.
Most say nothing more:
- No response text: 2,042 (54.1%)
- Only the word "Acknowledged": 1,366 (36.2%)
- Any other response: 364 (9.7%)
It is the same at the top. Of 24 acknowledged Criticals, 23 give no reason.
When teams do explain, the reasons fall into a few kinds:
- By design. On GMX POSU-1, a High, the team replied: "This is the desired behavior."
- A fix is planned. For Orderly GLOBAL-1, a Critical, the team planned to make users cover the cross-chain fee, in a feature due "in the next sprint".
- Not yet exposed. Baseline Markets H-04 was not an immediate issue on Blast, the team said, and would be addressed before other chains are supported.
- Documented instead. For g8keep H-01, the team's answer was to document that liquidity cannot be removed until snipe protection ends.
An acknowledged finding can be a sound decision or an open bug. Only the response, and what happened next, tells you which.
Declined, Pending and the Rest
Declined is rare: 9 findings. The team disagreed with the finding or rejected the fix.
PariFi declined ORDM-17 as by design. GMX declined OCL-1, saying Chainlink had told it the suggested checks were outdated.
Out of scope appears once: Synthetix M-08, a missing Chainlink staleness check.
Pending means no outcome was recorded: 577 findings in 34 reports. Reported covers 104 findings, all raised in a later round with no response yet.
18 reports record no outcome for any finding. They show what was found, not what was fixed.
Other firms use other words
In its OpenSSL assessment, Trail of Bits defines five fix statuses: Resolved, Partially Resolved, Unresolved, Undetermined and Risk Accepted.
Risk Accepted means "the issue persists and is not planned to be resolved".
On Code4rena, a sponsor can mark a submission Accepted, Fixed, Informative or Disputed.
Whatever the label, ask one question: is the issue fixed in the code that is deployed?
Questions for an Acknowledged Critical
173 Criticals and Highs in Guardian's public reports are acknowledged, and 90.8% of them give no reason. If one sits in a protocol you depend on, ask:
- Why was it not fixed? A design choice, a planned change or an accepted risk. Get it in writing.
- What makes it safe? Name the assumption, such as a trusted admin, one chain or a market list. Is it still true?
- Did the planned fix ship? Find the commit, and check whether an auditor reviewed it.
- Is the deployed code the reviewed code? See deployed vs audited code.
- What watches it? If the risk is handled offchain, who runs that control, and is it watched around the clock?
- Did a later round revisit it? Read every round: 61 of the 173 were raised after the main review.
With no answer, treat the finding as live.
For the rest of the report, see how to read a smart contract audit report. For how findings are rated, see smart contract audit severity levels.
How Guardian Reports Status
The portfolio lists 320 public Guardian reports, with each finding's severity, status, round and recorded response.
When a report's findings carry more than one status, its page adds a status menu. Use it to list only the acknowledged or partially resolved ones.
Vanguard leaves your team an invariant suite to retest fixes. It keeps reviewing changes to the audited scope for six months after production, up to 2,500 smart contract SLOC.
Frequently Asked Questions
What does acknowledged mean in an audit report?
The team accepted the finding, and the report records no fix. It can be a design choice, a planned change or an open bug. In Guardian's public reports, 90.3% of acknowledged findings give no reason beyond the status.
What is the difference between resolved and partially resolved?
Resolved means the report records the issue as fixed. Partially resolved means a fix landed but part of the issue remains, which the auditor's note should explain. It covers 1.9% of Guardian's public findings.
Is an acknowledged Critical a red flag?
Not always, but it needs a written reason. Ask why it was not fixed, what assumption makes it safe, and whether a later fix shipped. Without answers, treat it as live.
What does declined mean on an audit finding?
The team disagreed with the finding or rejected the recommended fix. It is rare: 9 of Guardian's 9,617 public findings. Read the team's reasoning before accepting it.
Sources
- Guardian: Public audit portfolio, 320 reports and 9,617 findings (as of November 6, 2026)
- Trail of Bits: OpenSSL Security Assessment, Appendix I, Fix Review Status Categories (April 18, 2024)
- Code4rena: Viewing submissions, sponsor platform guide
- Guardian: Reflex Protocol Review (May 14, 2026)
- Guardian: Gamma Strategies GMX V2 Vault (September 23, 2024)
- Guardian: Peapods Finance Leveraged Volatility Farming (November 11, 2024)
- Guardian: GMX Synthetics V2, Review 3 (March 15, 2023)
- Guardian: Orderly Perpetuals Protocol (October 23, 2023)
- Guardian: Baseline Markets Baseline V2.1 (June 17, 2024)
- Guardian: g8keep Token Launchpad (July 29, 2024)
- Guardian: PariFi Synthetics Perpetuals Exchange (September 3, 2023)
- Guardian: GMX Synthetics V2, Review 2 (January 8, 2023)
- Guardian: Synthetix BFP Market, Round 2 (October 28, 2024)
- Guardian: Vanguard audit
Get findings fixed, not just acknowledged
Vanguard leaves your team an invariant suite to retest every fix, and reviews changes for six months after production.