> For the complete documentation index, see [llms.txt](https://docs.efficientdex.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.efficientdex.com/reference/security-and-audits.md). # Security and audits The published audit reports and what each reviewed, how later code reaches Efficient pools, and the safeguards every pool enforces. This page covers three published audit reports, two from Sherlock and one from Cantina. All three reviewed contracts that came before Efficient. None of those contracts is part of Efficient's code today. ## Reports Each report lists the files and commits it reviewed. | Report | Review dates | What it reviewed | Findings | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- | | [Cantina, for Everlong](https://2024446185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuwAAFtSW8vuahbBI0d3e%2Fuploads%2FaUfxSliA1npujwfovMTj%2FEverlong%20Final%20Report%20Cantina.pdf?alt=media) | 4 to 10 December (no year given), report dated 23 April 2026 | EverlongALM (the earlier Everlong vault's liquidity rebalancer), its read-only helper contract ALMGetters and its library ALMLib | 1 medium, 4 informational | | [Sherlock, for Everlong](https://2024446185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuwAAFtSW8vuahbBI0d3e%2Fuploads%2FFarnzz1D5HDS1mMOGSnk%2FFinal%20Everlong%20Collaborative%20Audit%20Report%20Sherlock.pdf?alt=media) | 18 to 28 October 2025 | The managed leveraged vaults and their read-only helper contracts, a spot price oracle, and the leverage and deleverage routers | 1 medium, 3 low or informational | | [Sherlock, for Beraborrow](https://2024446185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuwAAFtSW8vuahbBI0d3e%2Fuploads%2FNFElyXKzAKB8hF7gWFQT%2FManaged%20Leveraged%20Vaults%20v1%20%26%20v2%20-%20Private%20Audit%20Sherlock.pdf?alt=media) | 3 to 7 July 2025 | The base managed leveraged vault, its v1 and v2 versions, and read-only helper contracts for the base and v2 | 7 high, 4 medium, 8 low or informational | Sherlock wrote the July 2025 report for Beraborrow, the project the Everlong team worked on before Everlong. Each report names two researchers. Each review took five to eleven days and covered code only. ## Findings Each report's summary marks every finding as fixed or acknowledged. An acknowledged finding isn't always fixed. One high finding in the July 2025 report was acknowledged without a code change. Cantina and Sherlock rate findings differently. Cantina rates each finding by likelihood against impact. Sherlock puts more weight on how directly someone could exploit the issue. A Cantina medium isn't necessarily the same as a Sherlock medium. So the individual findings are a better guide than the counts. ## What the reports cover Efficient's contracts came after the code these reports reviewed. They are the pool, the financing router and its Morpho Blue accounts, the factory, the price feed and the hooks. The contracts around the pool that depositors use came later too. These are the asset router, the entry market, the tranche contracts and the deposit allowlist. [Smart contracts](/reference/smart-contracts.md) covers what each one does. Efficient's code is in audit now, including the pool's loan-to-loan swap logic. No report on it is published yet. Each report checks the files it lists for bugs. It doesn't assess whether a pool's settings are sound, or how its price feed and any lending market will behave. [Risks and safeguards](/use-efficient/risks-and-safeguards.md) covers those. ## How code changes after a review **An audit reviews the code at one commit, then checks the fixes made after it.** So it doesn't cover later changes. The factory, the financing router and its Morpho Blue accounts can't be upgraded. Efficient's price feed can't be upgraded either. Its Safe can still replace a token's price source after a delay. [Price feeds and oracles](/how-pools-work/price-feeds-and-oracles.md) explains how. New pool code reaches every pool at once. The protocol Safe schedules it, and anyone can execute it after the factory's upgrade delay. The first Everlong vault's redeployment sets that delay at 10 days. See [Deployments](/reference/deployments.md). The protocol Safe can also add a venue type, meaning a new kind of lending market. It can replace an existing type's account deployer too, Morpho Blue's included. Both changes wait out the factory's upgrade delay. Only accounts deployed after a replacement use the new deployer. A pool takes new hooks through a hook-set change. That change waits out the pool's governance delay. In the first Everlong vault's redeployment, that delay is also 10 days. [Roles and governance](/run-a-pool/roles-and-governance.md) covers who controls each change. It also shows how to see a scheduled change before it executes. ## Safeguards in every pool **Every pool's code enforces the same checks, no matter which hooks its pool operator chooses.** A pool's settings decide which of those checks apply. A pool with a price band requires each fill, fee included, to price within that band around the feed price. A pool that borrows lets a sell borrow only as far as the pool's credit check allows. A pause never stops a proportional exit, in any pool. See [Risks and safeguards](/use-efficient/risks-and-safeguards.md) for each safeguard and its limits.