Stablecoin security audit
A stablecoin fails at the mint, the keys or the bridge long before it fails at the peg. Guardian audits all three, and verifies every new chain before it goes live.
Stablecoin audits for
Jupiter
Onchain · Stablecoin Audit
Every unit minted, backed. Every chain, verified.
- Mint and burn Mint authority, per-call and rate limits, signature checks, and minting only against assets actually received.
- Roles and keys Minter, pauser, blocklister and upgrader roles: who holds each, multisig thresholds, timelocks and rotation.
- Freeze and blocklist Freeze, blocklist and seize paths, and whether transfers, permits or bridges can route around them.
- Upgrades Proxy storage layout, initializers and upgrade authority, for an architecture copied to every chain.
- Oracles and redemption Price feeds, PSMs, redemption queues and the rounding in every mint and redeem.
- Multichain supply OFT peers, DVN sets, confirmations and rate limits, migrations, and total supply against backing across chains.
Covers fiat-backed, crypto-collateralized and synthetic designs on EVM chains, Solana and Stellar. The invariant suite fuzzes the property that matters most: supply never exceeds backing. Deployment verification for each new chain runs as its own engagement.
Published work
Stablecoins Guardian has reviewed.
- Client storyUSDT050+ engagements on Tether's omnichain stablecoin, across 25+ chains.
- Case studyUSDT0 deployment verificationBytecode, roles, peers and DVNs checked before each chain went live.
- ReportUSDT0 on PolygonA migration playbook that would have left USDT0 unbacked, fixed before it ran.
- Client storyEthenaOnchain minting, EthenaPay, twelve engagements and a $100,000 public contest.
- ReportJupUSD on SolanaJupiter's stablecoin program end to end: no Criticals, Highs or Mediums.
- ReportsM0mUSD, USD8, PYUSDX and the M extensions behind them.
Recent incidents
The failures a stablecoin audit tests for.
-
$292MKelp DAO
A LayerZero route trusted one DVN. Fooled into attesting a burn that never happened, it released 116,500 rsETH with nothing behind it.
-
$25MResolv
Attackers reached the minting key and minted 80M unbacked USR. Nothing onchain capped the mint.
Mar 2026 Our breakdown of the Resolv incident
-
300T PYUSDPaxos
An internal transfer minted about 115,000 times PYUSD's market cap by mistake. No limit rejected it.
Oct 2025 Our breakdown of the Paxos incident
“We very much appreciate Guardian’s approach to security and the entire audit process.”
Core TeamUSDT0“You guys did an ace job here as always really appreciate your efforts so far”
Core TeamEthenaQuestions
Stablecoin audit questions
What does a stablecoin audit cover?
The contracts that mint, burn, freeze and upgrade the token, the roles and keys that control them, any oracle, PSM or redemption logic, and the bridge configuration on every chain. Reserve attestations are a separate financial review: see audits, attestations and assurance.
Do you verify deployments on new chains?
Yes, as its own engagement. For USDT0, Guardian has matched deployed bytecode against the audited source, confirmed every privileged role, and checked peers, DVNs and each queued multisig transaction on more than 25 chains. The per-chain checklist lists each check.
Which regulations ask for a stablecoin audit?
It depends on where you issue. The stablecoin regulation guide compares reserve, key, freeze, audit and incident rules across six regimes, and Regulatory & Compliance Assessments map your controls to them.
How much does it cost, and how long does it take?
Guardian scopes every audit from your repository and commit, so there is no list price. The cost estimator gives a range from nSLOC, and how long an audit takes covers review windows, code freeze and fix review.
Smart Contract Audit
Other engagements
- Featured · Onchain Vanguard Audit A security audit designed to protect onchain teams facing unprecedented cyber risk. Explore Vanguard
- Managed services Managed Security Dedicated response team, red team, 24/7 attack and defense across every surface you run, onchain and off. Explore Managed Security
- OnchainSmart Contract AuditTwo competing teams, Helix AI and invariant fuzzing.
- OnchainSolidity AuditAccess control, reentrancy, math, upgrades and assembly.
- OnchainSolana AuditRust and Anchor programs: accounts, PDAs, CPIs and Token-2022.
- OnchainDeFi Protocol AuditAccounting, oracles, liquidations and integrations.
- OffchainOpSec AuditKeys, signers, privileged roles, and critical operations.
- Penetration testingAll pentestsEvery offchain engagement, and how Guardian runs them.
Start now