Vulnerability Remediation Rate by Severity: What Gets Fixed
Quick answer. About half: 51.7% of the 9,617 findings in Guardian's 320 public audit reports were resolved, and 39.2% acknowledged. Fix rates rise with severity, from 41.8% of Informational findings to 71.2% of Highs and 84.5% of Criticals.
Video transcript
About half of smart contract audit findings get fixed, and the rate climbs with severity. In Guardian's 320 public reports, 51.7 percent of 9,617 findings were resolved.
Teams resolved 84.5 percent of Criticals and 71.2 percent of Highs, against 41.8 percent of Informational findings.
Acknowledged moves the other way, from 7 percent of Criticals to 48.4 percent of Informational findings.
Still, 296 of 1,188 Criticals and Highs, about a quarter, were not marked resolved.
Bugs that break protocol rules usually get fixed, like 90 percent of serious access control findings. Warnings and trust assumptions are mostly acknowledged. Cheap fixes get done, including 86.3 percent of typos.
Acknowledged is the second most common outcome, yet 90.3 percent of those findings give no reason. An acknowledged High can be a sound design choice or an open bug.
Treat fix rate as a reading aid, not a score. Check every Critical and High status, ask why for each acknowledged finding, and read later rounds, where serious findings were resolved just 43.9 percent of the time. Treat pending as unknown.
Every report here is public in the Guardian portfolio. Read the full article, or talk to Guardian about Vanguard, which keeps reviewing changes to audited scope for six months after production.
An audit report lists what was found. Its statuses show what happened next.
We measured the vulnerability remediation rate across Guardian's public audit portfolio: the final status of every finding, by severity, category and protocol type.
This counts what got fixed, not how fast. For timing, see audit remediation timelines.
How We Counted
The data is all 320 reports in Guardian's public portfolio on November 5, 2026. They hold 9,617 findings for 99 clients, dated March 2022 to October 2026.
Fixed means the published report marks the finding resolved. Nothing else counts as fixed, including partially resolved.
Each finding carries one status. These are the values exactly as the data spells them:
resolved: the report marks the issue fixed.partially_resolved: a fix was made, but part of the issue remains.acknowledged: the team accepted the finding, and no fix is marked resolved.pending: no final outcome recorded.reported: raised in a later review round, with no response recorded.declinedandout_of_scope: disputed by the team or ruled out of scope (10 findings).
Limits. Status is what each published report recorded. A fix made after publication is not counted, and private reports are missing.
Fix Rates by Severity
| Severity (findings) | Resolved | Partially resolved | Acknowledged | Pending | Other |
|---|---|---|---|---|---|
| Critical (343) | 84.5% | 3.2% | 7.0% | 5.2% | 0.0% |
| High (845) | 71.2% | 4.0% | 17.6% | 5.7% | 1.4% |
| Medium (2,133) | 52.9% | 2.9% | 36.1% | 6.2% | 1.9% |
| Low (4,234) | 49.4% | 1.1% | 43.2% | 5.4% | 0.8% |
| Informational (2,062) | 41.8% | 1.3% | 48.4% | 7.3% | 1.3% |
| All (9,617) | 51.7% | 1.9% | 39.2% | 6.0% | 1.2% |
"Other" is reported, declined and out of scope.
Severity is the clearest signal. The more serious the finding, the more likely it was fixed.
Acknowledged moves the other way, from 7.0% of Criticals to 48.4% of Informational findings.
Still, 296 of 1,188 Criticals and Highs (24.9%) were not resolved: 53 Criticals and 243 Highs.
Per report
181 reports contain a Critical or High. 99 of them (54.7%) resolved every one.
91 reports contain a Critical, and 75 of those (82.4%) resolved every Critical.
Pending is concentrated
Pending and reported findings total 681, in just 38 reports. Five reports hold half of them (50.4%).
18 reports record no outcome for any finding. They show what was found, not what was fixed.
Fix Rates by Category
Categories are each report's own label, with spelling variants merged. The last column appears only where a category has 30 or more Criticals and Highs.
| Category | Findings | Resolved | Acknowledged | Critical and High resolved |
|---|---|---|---|---|
| Logical Error | 2,175 | 57.9% | 33.6% | 77.6% of 626 |
| Validation | 1,117 | 55.6% | 34.6% | 72.4% of 87 |
| Warning | 812 | 30.3% | 61.5% | n/a |
| Unexpected Behavior | 668 | 41.6% | 47.2% | 60.0% of 30 |
| DoS | 653 | 58.2% | 32.5% | 77.0% of 165 |
| Best Practices | 504 | 59.5% | 33.7% | n/a |
| Access Control | 134 | 56.7% | 32.8% | 90.0% of 30 |
| Gaming | 129 | 41.1% | 50.4% | 65.7% of 35 |
| Trust Assumptions | 75 | 28.0% | 56.0% | n/a |
| Typo | 73 | 86.3% | 9.6% | n/a |
Bugs that break the protocol's rules usually get fixed. At Critical and High, 90.0% of Access Control, 77.6% of Logical Error and 77.0% of DoS findings were resolved.
Findings that describe a choice are mostly acknowledged. That was the outcome for 61.5% of Warnings and 56.0% of Trust Assumptions.
Cheap fixes get done: 86.3% of typos were resolved.
Unexpected Behavior and Gaming trail among serious findings, at 60.0% of 30 and 65.7% of 35 resolved.
Fix Rates by Protocol Type
Sectors are the report's tags, or the client's when it lists none. These have 20 or more reports.
| Sector | Reports | All resolved | Criticals and Highs | Of those, resolved |
|---|---|---|---|---|
| Perpetuals | 77 | 47.3% | 407 | 77.1% |
| Stablecoins | 57 | 43.3% | 18 | 94.4% |
| DEXs and AMMs | 32 | 47.6% | 261 | 60.2% |
| Infrastructure | 29 | 35.6% | 42 | 50.0% |
| Lending | 27 | 57.7% | 97 | 92.8% |
| Cross-chain | 25 | 35.7% | 13 | 100.0% |
| Yield and vaults | 24 | 57.1% | 152 | 73.7% |
| Token launches | 22 | 64.5% | 137 | 73.7% |
Lending stands out. Its teams resolved 92.8% of 97 Criticals and Highs.
DEXs and AMMs resolved 60.2% of 261. One client accounts for 29 of the 104 not resolved, across five reports.
Infrastructure and cross-chain look low overall for another reason: 30.4% and 31.9% of their findings are still pending or reported.
Perpetuals lean on GMX. Its 43 perpetuals reports resolved 88.7% of 168 Criticals and Highs. The other 34 resolved 69.0% of 239.
What Acknowledged Really Means
Acknowledged is the second most common outcome: 3,772 findings, or 39.2%.
It means the team accepted the finding and no fix is marked resolved. Most entries do not say why:
- No response text: 2,042 (54.1%)
- Only "Acknowledged": 1,366 (36.2%)
- Any other response: 364 (9.7%)
The same holds at the top. Of 173 acknowledged Criticals and Highs, 130 carry no response text and 27 say only "Acknowledged".
When teams explain, the reasons differ:
- A design choice. Ambit Finance (GLOBAL-2) treats USDT as one dollar. It lends only USDT, so its liabilities and borrow limits are in USDT.
- A change if scope grows. Abracadabra Money (GMOCL-1) said its oracle setup is expected for its planned markets. It would make a change if it chose to support DOGE or similar ones.
Two rarer outcomes need the same reading:
- Partially resolved. After a partial fix at Rest Finance (ISU-3), Guardian noted a user could still block anyone's early withdrawals.
- Declined. Synthetix (H-06) declined a liquidation High. After a partial liquidation, it said, funding shifts from the trader to LPs.
An acknowledged High can be a sound decision or an open bug. Only the response tells you which.
Using Fix Rate in Due Diligence
Fix rate is a reading aid, not a score. Use it to decide where to look:
- Read every Critical and High status. 82 of 181 reports with one (45.3%) left at least one not resolved.
- Ask why for each acknowledged finding. 90.3% carry no reason in the report.
- Read later rounds. Later-round Criticals and Highs were resolved 43.9% of the time, against 73.7% from the main review.
- Treat pending as unknown. It is neither a fix nor a refusal.
- Read recent reports closely. 57.1% of 2026 Criticals and Highs were resolved. Five reports hold 51 of that year's 53 acknowledged ones.
- Confirm what deployed. A fix counts only if the fixed code shipped: see deployed vs audited code.
The round comparison covers the 127 reports with more than one review round. For everything else in a report, see how to read a smart contract audit report.
How Guardian Reports Fixes
Every report in this analysis is public in the Guardian portfolio, with the round, final status and recorded response of each finding.
A Guardian smart contract audit builds invariant harnesses so fixes and future changes can be pressure-tested repeatedly.
Vanguard keeps reviewing changes to the audited scope for six months after production, up to 2,500 smart contract SLOC. For the wider dataset, see the smart contract audit statistics.
Frequently Asked Questions
What percentage of smart contract audit findings get fixed?
About half. In Guardian's 320 public reports, 51.7% of 9,617 findings were resolved and 39.2% acknowledged. Teams resolved 84.5% of Criticals and 71.2% of Highs.
What does acknowledged mean in an audit report?
The team accepted the finding, and the report marks no fix as resolved. It can be a design choice, a planned change or an open issue. 90.3% of acknowledged findings in Guardian's reports give no reason beyond the status.
What is the difference between resolved and partially resolved?
Resolved means the report marks the issue fixed. Partially resolved means a fix was made but part of the issue remains. It covers 3.8% of Criticals and Highs in Guardian's reports.
Is remediation rate the same as time to remediate?
No. Remediation rate counts how findings end. Time to remediate measures how long fixes take, which Guardian covers in a separate report on audit remediation timelines.
Sources
- Guardian: Public audit portfolio, 320 reports and 9,617 findings (as of November 5, 2026)
- GitHub: GuardianAudits/Audits, the published report PDFs
- Guardian: Ambit Finance Borrowing and Lending Platform (December 6, 2023)
- Guardian: Abracadabra Money GMX V2 Cauldron (November 14, 2023)
- Guardian: Rest Finance EigenLayer LST Vault (January 26, 2024)
- Guardian: Synthetix Perps V3 (October 28, 2024)
- Guardian: Smart contract audit
- Guardian: Vanguard audit
Close your findings with Guardian
Vanguard leaves your team an invariant suite to retest every fix, and keeps reviewing changes for six months after production.