Guardian’s Ethena work centres on two systems. The onchain minting contracts mint and redeem xUSD across chains, with a LayerZero bridge, a rate limiter and a multi-source oracle stack; they were Ethena’s largest Guardian scope, over four review rounds. EthenaPay, the passkey smart wallet, has been reviewed three times as it has grown.
Onchain minting and EthenaPay
The onchain minting review was Ethena’s largest Guardian engagement: seventeen contracts across the minting system, the xUSD OFT bridge and rate limiter, and the Chainlink, Pyth and aggregate oracle feeds, with a dedicated invariant fuzzing suite over the bridge path. It closed with no Criticals or Highs.
EthenaPay has had the most sustained attention: a full review in March 2026, a review of everything that changed since in June, and a third engagement in September. Reviewing each change rather than each release is what keeps a wallet that holds user funds safe as it grows.
The $100,000 contest
After the timelock review, Guardian put the same contract into a public contest through Guardian Defender with a $100,000 prize pool, running from 21 July to 20 August 2025.
Thirteen submissions came in. All thirteen claimed Critical severity. All thirteen were rejected. Seven of them attacked the same surface (whitelisted-executor timelock bypass, selector collision, replay), which is exactly the mechanism Guardian’s own review had already fuzzed as an invariant. It held.
An audit that says “we found nothing critical” is a claim. An audit followed by a funded month-long public attempt to prove otherwise is evidence.
Extensive ecosystem work
Guardian’s work extends across the ecosystem built on Ethena. For Jupiter, Guardian reviewed its implementation of onchain minting for the JupUSD stablecoin across three engagements. For Mysten Labs, Guardian reviewed suiUSDe, its implementation of onchain minting on Sui, and a later update to it.
Ethereal, the Ethena-native DEX settling on Converge, has had seven engagements of its own, from its vault and orderbook settlement contracts to an off-chain review and its Rust sequencer. Ethereal’s documentation lists Guardian for two of the three audits it names.
The engagements
Nine reviews between May 2025 and September 2026, plus the contest that followed the first of them. The rail alongside tracks where you are.
May 2025
The timelock: five auditors on ninety-six lines
EthenaTimelockController.sol · 96 source lines · 5 auditors
Ethena’s timelock governs privileged execution across the protocol. It is ninety-six lines of source, and Guardian put five auditors on it, because the consequence of a defect here has nothing to do with the line count.
One Medium, two Lows and nineteen Informational, no Criticals or Highs.
- 0Critical
- 0High
- 1Medium
- 2Low
- 19Info
Highlighted finding · M-01
Native asset transfers always reverted: the execution path rejected empty calldata, so a plain ETH transfer through the timelock could never run, unlike the stock OpenZeppelin TimelockController. Resolved.
Read the report →
Jul – Aug 2025
$100,000 Defender contest
Guardian Defender contest · $100,000 prize pool · 21 Jul – 20 Aug 2025
The same timelock, open to the public for a month with $100,000 on the table. Thirteen submissions claimed Critical impact; none held up under the deployed configuration. The contest code is public.
See the contest repository →
Aug 2025
Deployment review
Production deployment script · role configuration
A one-day review of the production deployment script before the timelock went live. One informational finding.
Oct – Dec 2025
The onchain minter: 1,749 source lines, four rounds
OnChainMinting · xUSD and its OFT bridge · Chainlink, Pyth and aggregate oracles · 4 auditors
The largest Ethena scope: the onchain minting system behind xUSD, its LayerZero OFT bridge and rate limiter, and the oracle stack. Four rounds, with a dedicated invariant fuzzing suite over the bridge path.
One Medium, nineteen Lows and fifty-two Informational, no Criticals or Highs.
- 0Critical
- 0High
- 1Medium
- 19Low
- 52Info
Highlighted finding · M-01
Two xUSD bridge sends in the same block would revert against the rate limiter, a liveness failure that would appear exactly when volume peaked. Resolved. The oracle Lows are also worth reading, including future-dated Chainlink prices and a thirty-hour Redstone staleness window.
Read the report →
Mar 2026
EthenaPay
Diamond-pattern smart wallet · 3,466 source lines · passkey, auth and recovery facets · WebAuthn and EIP-712
EthenaPay is a passkey smart wallet on the Diamond pattern. Guardian reviewed every facet and the WebAuthn and EIP-712 libraries underneath. Three Mediums, six Lows, twenty-three Informational.
Read the report →
Mar 2026
The Safe execution guard
EthenaSafeGuard.sol · 257 source lines
The execution guard enforces a per-call whitelist on everything Ethena’s multisig executes: the control on the controls.
Read the report →
Jun 2026
The peg-stability module
PSM.sol · 880 source lines · tests and deployment script
A three-day review of the peg-stability module. One Medium, three Lows, five Informational.
Read the report →
Jun 2026
EthenaPay updates
Changes since the March review · AuthFacet, ERC1271Facet
EthenaPay had already passed a full Guardian audit in March. The June review covered only what had changed, and still returned three Highs, ten Mediums, twenty Lows and twenty Informational.
- 3High
- 10Medium
- 20Low
- 20Info
Read the report →
Aug 2026
PSM adapter and deployment review
EthenaPSMAdapter · interfaces · UnitOracleFeed
The most recent completed engagement, and the quietest: one Low and six Informational findings. By now, most of what earlier reviews taught is already in the code before it reaches Guardian.
Read the report →
Sep 2026
EthenaPay PR #12
BatchExecutor · RecipientPolicy · factory, allowance and auth changes
The third EthenaPay engagement, reviewing the wallet’s batch execution and recipient policy.
Looking for a partnership like this?
We work closely with our partners to address their most critical security needs: every update reviewed as it ships, every deployment checked before it goes live, by a team that already knows the codebase. Tell us what you’re building and we’ll scope a long-term partnership around it.
Get a quote
