Audit reports

The IRIS core contracts have been reviewed by two outside firms. Both reports are published in full.

​

Guardian, September 2026

Guardian reviewed Iris Protocol over two rounds, a main review and a remediation review, between 27 August and 25 September 2026. The final report is dated 29 September 2026. Guardian’s scale describes a 4 as code that is clean and well structured, suitable for deployment after remediations, with periodic review as the protocol changes. Read the Guardian security review

​

Hexens, July 2026

Hexens ran a full review of the code over one week in July 2026, led by Jahyun Koo, with the final report dated 17 July 2026. Hexens does not publish a confidence score, so there is no equivalent of Guardian’s ranking here. Read the Hexens security review

​

What a review does not cover

An audit reviews contract code at a point in time, against the commit the firm was given. It does not cover the lending venues your loan opens on, the oracles those venues price your collateral with, or a solver’s own systems. For the risks that stay with you, see What you still manage.