The audit

There has not been one. That sentence is the whole status.

An audit is the step between a pool that works on devnet and a pool that is allowed to hold real money.

What it has to cover

• The circuits: that a proof can only be made by someone who holds a receipt.
• The program: deposits, the tree, nullifiers, the withdraw path, and the pause key’s limits.
• The ceremony that produced the keys, and who took part in it.
• The relayer: that a hostile one can delay a withdrawal and nothing more.

What it does not do

An audit lowers risk; it does not remove it. Audited contracts have been drained before. Treat a report as one piece of evidence, read the findings rather than the badge, and size your deposits accordingly.