> For the complete documentation index, see [llms.txt](https://docs.ensemble.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ensemble.io/safety/audits-and-security.md). # Audits and security Read Ensemble's public Pashov security review and its completed remediation outcomes. Ensemble completed an external security review with Pashov Audit Group. The public report records 65 findings, all marked Fixed after the auditor reviewed the remediations. That gives holders and integrators concrete evidence to inspect, from vault accounting to asynchronous trading and recovery. [Read the Pashov Audit Group security report](https://github.com/pashov/audits/blob/master/team/pdf/Ensemble-security-review_2026-09-14.pdf). ## What the review covered Pashov reviewed Ensemble from July 20 to August 10, 2026. The report lists 16 medium and 49 low findings, with no high or critical findings listed. The scope includes BullVault, BearVault, VolVault, their shared leveraged-vault base and share token; HyperCore reads, CoreWriter, bridge, accounting and execution libraries; CircuitBreaker, VaultAdmin and VaultLens; and CCIP pools, tokens, composer and router. The findings address practical protocol boundaries: settlement, emergency recovery, fees and user transaction controls. The builder-fee remediation uses Ensemble's own HyperEVM charge rather than a native HyperCore builder deduction. ## Evidence you can use A public report makes the review inspectable. Read the finding, resolution and status together, then consider the contracts you intend to use. The report gives you the findings and remediation evidence behind the security review. Inverse vault implementations are not separately listed in the report. The report covers the listed contracts and reviewed changes; later deployments and upgrades are not automatically covered. Use the [contract addresses](/protocol-transparency/contract-addresses.md) and current implementation reads to verify what you interact with; upgrades and mutable settings can change protocol behavior. External review supports confidence in the engineering process. Leveraged market losses, constrained redemption liquidity and software risk still remain. Review the selected vault's strategy and [current controls](/reference/parameters-and-limits.md) before depositing. ## Reporting a concern Send suspected vulnerabilities privately to . Include the contract, network, relevant addresses and reproduction steps or transaction hashes. Never send seed phrases or private keys. Keep exploit details private while the report is reviewed.