What was reviewed — and where it stops.
The report is public, so a third party can check it without going through us. Read the scope before the conclusion.
Covered, and not covered.
Covered by NM_0828
- The state engine and operation lifecycle
- Roles and permissions
- Ownership, broadcaster and recovery
- Guarded execution
- Core
Accountcontract (contracts/core/)
Not covered
- Account factories, including BasicFactory
- The BasicAccount implementation
- Example contracts and custom extensions
- Anything you build on top — your code needs its own review
BasicFactory and BasicAccount are not in NM_0828. See the engagement README (opens in a new tab) for the full scope list.
What an audit is not.
An audit reduces risk; it doesn’t remove it. It isn’t a deployment guarantee or a statement of production readiness, and deployments and Platform availability are separate facts. We keep them separate on every page.
Deployment verification
The official CreateX deployment catalog has been checked across all 15 listed networks against the @bloxchain/contracts@1.2.0 release.
The verification includes on-chain code presence, normalized runtime-bytecode matching, and implementation-level configuration checks. Additional account-instance checks were completed on three sampled networks.
These results establish deployment and implementation integrity within the documented verification scope. They do not constitute a security audit or a guarantee of production safety.
- Bytecode matching is normalized. Compiler metadata and documented immutable values are excluded, so this is not literal byte-for-byte equality.
- Implementation checks ran on all listed networks. Account-instance behaviour was sampled on three networks using existing deployments.