Audits
An independent audit of the Cosmic Signature contracts by Hacken, the formal verification and analysis kept in the contracts repository, and how to check a contract yourself.
Audit at a glance
Auditor HackenReport published
- Findings
- 23
- Critical or high
- 0
- Invariants held
- 14 of 14
- Fuzzing runs
- 10,000
Findings by severity
- Critical0
- High0
- Medium3
- Low8
- Informational12
In late 2025, Hacken carried out an independent security review of the Cosmic Signature smart contracts. The engagement covered the production contracts in the public repository: the core protocol that runs each cycle, the CST token, both NFT collections, the anchoring wallets, and the wallet and system management contracts that support them. Hacken published the final report in January 2026.
The report lists each finding with its severity and its status; the summary above counts them. None is critical or high severity, and most describe design tradeoffs the team reviewed and accepted.
Alongside the manual review, Hacken fuzz-tested the system’s invariants, properties such as the rule that the ETH the protocol holds always equals what came in minus what went out. Every invariant held.
The contracts repository also carries the checks the team runs itself: Certora Prover specifications for the protocol logic, ETH conservation, access control and the wallet contracts; a Solidity SMTChecker configuration; Slither static analysis; and an automated test suite.
These checks prove or test the properties they state, and no more. Like the audit, they reduce risk without removing it; see the risk disclosures.
- Certora specificationsThe properties the Certora Prover checks, with the configuration of each run (opens in a new tab)
- SMTChecker configurationScripts that compile the contracts with the Solidity model checker enabled (opens in a new tab)
- Slither analysisStatic analysis and upgradeability checks, with notes on running them (opens in a new tab)
- Test suiteThe contracts’ automated tests (opens in a new tab)
Before you interact with a contract, you can confirm each of these yourself:
- Find the contract’s address on the contracts page, the one list of official addresses.
- Open the address on Arbiscan (opens in a new tab) and confirm it is on Arbitrum One with verified source code.
- Compare that source with the public repository (opens in a new tab), or check the exact match on Sourcify (opens in a new tab).
- Read the Hacken report (opens in a new tab) for every finding and its status.
- Confirm that what the app shows matches the contract’s behavior on-chain.