Skip to main content
Security audits are essential for DeFi protocols. This page details TED Protocol’s audit status and security practices.

​
Audit Status

​
Completed Audit

​
Audit Scope — Please Read

The audit covered three source files: TEDP.sol, TedpOFT.sol and TedpOFTAdapter.sol. The TEDP token contract currently in circulation on Polygon (0xdc6909563a4e5c4599aE1F63c81E5d466de4E928) is a different contract from the audited TEDP.sol and is outside the audit scope. Mainnet deployment (2026-03-02) preceded the finalisation of the audited code (2026-03-23), and the deployed build differs from the audited one. We state this plainly rather than letting “audited by Verichains” be read as covering everything. The bridge contracts were redeployed from the audited code on 2026-08-17 and are registered on Sourcify with an exact match.

​
Continuous Security

  • Automated scanning runs continuously through internal tools
  • Dependency monitoring via Dependabot
  • Static analysis using Slither

​
Audit Scope

​
Core Contracts

​
Token Contracts

​
Security Practices

​
Development Process

  • All code changes reviewed by multiple developers
  • Unit, integration, and fuzz testing required for every change
  • Automated vulnerability scanning on all commits
  • Extended testnet deployment before mainnet releases

​
Test Coverage Targets

All testing is in progress.

​
Security Patterns

All patterns follow OpenZeppelin’s well-established implementations.

​
Bug Bounty Program

TED Protocol operates a bug bounty program to incentivize responsible disclosure.

​
Rewards

​
Scope

In scope:
  • Smart contracts on all supported chains
  • Bridge integrations
  • TEDP token contracts
  • Cross-chain messaging logic
Out of scope:
  • Frontend/UI issues
  • Third-party services
  • Previously reported issues
  • Social engineering attacks

​
Reporting

Submit security vulnerabilities to security@tedprotocol.io. Include:
  • Detailed description of the vulnerability
  • Steps to reproduce
  • Potential impact assessment
  • Suggested fix (if applicable)
Response times:

​
Third-Party Dependencies

TED Protocol relies on well-audited dependencies.

​
Dependency Management

  • Locked versions in package files
  • Automated vulnerability alerts
  • Regular dependency updates
  • No unaudited external calls

​
Emergency Procedures

​
Incident Response Timeline

​
Emergency Controls

Administrative authority over the token, vesting and bridge contracts is held by a 2-of-3 Gnosis Safe at 0x5B72ac1CB423896E372960da7ABF1CFb03e74c2d (same address on all six chains). A transaction guard enforces a 48-hour announcement delay on the dangerous calls. You can verify the signer set and threshold on chain with getOwners() and getThreshold().

​
Transparency

​
Open Source

We list the last row rather than claiming blanket verification. The swap protocol proxy addresses are published above; their implementation sources are being registered.

​
Upgrade History

All contract upgrades are documented with:
  • Upgrade rationale
  • Code changes
  • Audit status
  • Timelock period