PRIVATE AUDIT RESEARCH · ONE KEY HOLDER

Audit
Coverage
Index.

An audit covers a commit, not a protocol. Every upgrade shipped after the auditors signed off is code that was never in scope. This is the desk where that gap gets worked — protocol by protocol, with the dates showing. Nothing here is published until it is finished.

Enter the workspaceWhat is in there
AN AUDIT COVERS A COMMIT — NOT A PROTOCOLPRIVATE RESEARCH · NOT PUBLISHEDTHE COMMITS ARE CONFIRMED BY HANDMEASURED, NOT SCORED

BEHIND THE KEY

The research desk.

One password, one holder, no accounts. Everything past the gate is working material: unfinished targets, unsent disclosures, and notes that stay wrong until somebody checks them.

QUEUEThe curated band, ranked. Money, audit presence, category and chain — filtered down to the protocols worth a week.
TARGETSA pinned contract per protocol: deployment date, upgrade history, proxy authority, whether the source is even verified.
FINDINGSWhat the review turned up, recorded against the deployment it belongs to. Pointers to proof — never exploit code.
DISCLOSUREThe timeline. Contacted, acknowledged, fixed. Dates, not adjectives.

THE MEASUREMENT

Four states. No score.

Coverage is a fact about git ancestry, not a rating. The desk resolves the most recent audit whose reviewed commit is an ancestor of what is deployed on-chain, then measures the days of code that landed after it. Both commits are confirmed by hand — no external source can supply either, so nothing here guesses. There is no weighting and no composite number to game.

UncoveredThe deployed code is downstream of every audit. Nobody reviewed it.
DriftedAn audit covered this code once. It has been upgraded since.
CurrentAn audit covers the deployed commit, and nothing shipped since.
UnknownNot enough recorded data to evaluate. We do not guess.

On what this is not

An uncovered deployment is not a vulnerability, and nothing here claims one. It says only that the code running on-chain was never in an audit's scope. That is a measurable fact about coverage — and establishing it, before a single word goes out to a protocol team, is the whole job.

Enter the workspace