# Trustblock · The open data layer for web3 security > Trustblock is the open data layer for web3 security. It keeps one open security record per web3 project: which > security firms reviewed its code, what they found, and which findings are still open. The records are free to > read at trustblock.run and open to build on through the Trustblock API. Every audit is attributed to the security firm that performed it: most are submitted by the firm, and some are collected by Trustblock from the firm's public pages. Each carries the firm's name, the date the audit was conducted, the issues the firm reported, the contracts in scope, and, where available, a link to the firm's own report. Trustblock does not rate or endorse the audits it publishes. Generated 2026-10-20. Every figure below is dated, because each is measured at a different time. ## Where to start - Projects, by value locked: https://app.trustblock.run/ - Security firms, A to Z: https://app.trustblock.run/auditors - Every security firm on one line each (name, page, audit reports, years with a report), A to Z: https://app.trustblock.run/llms-full.txt - Playground (the project label, the security firm widget and the contract page card, with their code): https://app.trustblock.run/playground - Trustblock's front page: https://trustblock.run (for security firms: https://trustblock.run/security-firms) ## How to read an audit here - The security firm and the date come from the firm's own submission or published page. An audit is a statement about work performed on a date; it says nothing about the state of the code today. - Issue counts and severities are the security firm's classification, not ours. - Contracts are listed per audit and per project, with the chain and address where they are on-chain. ## Methodology - How Trustblock classifies security reports (what counts as an audit report, its three types, what is not an audit): https://docs.trustblock.run/methodology/classify-security-reports ## What each page's first sentence states Each page opens with one dated sentence, which is also its meta description. - Project page, https://app.trustblock.run/project/{projectSlug}: "As of {date}, {project} has {n} audit reports by {m} security firms on Trustblock; the latest is by {firm}, dated {date}.", then the open critical findings those reports list. - Audit page, https://app.trustblock.run/audit/{auditId}: "{Firm} reviewed {project} ({report title}) on {date}: {n} findings, {c} critical;", then how many of them the firm marks fixed, acknowledged or open. - Security firm page, https://app.trustblock.run/auditor/{auditorSlug}: "As of {date}, {firm} has reviewed {n} projects in {m} audit reports on Trustblock, dated from {month} to {month}. The latest is “{report title}”, dated {date}." ## The catalogue, as of 2026-10-20 - 9,797 audits (human reviews), from 59 security firms with at least one published audit. - 6,605 projects carry at least one audit. - 75,116 reported issues; 54,124 contracts, of which 22,146 are on-chain. - 5,907 audits link to a report hosted by the security firm, and 3,918 have a report file hosted by Trustblock on IPFS. - The most recent audit in the catalogue was conducted on 2026-10-18. - 2 automated scans are also listed, marked as such, and are not counted in the figures above. ## What is known to be incomplete, as of 2026-10-20 - Of the 5,907 report links hosted by the security firms, 421 were unreachable as of 2026-09-13. That figure is a 2026-09-07 survey adjusted for links repaired and confirmed by hand since; it is not a fresh survey. 3 of the 421 resolve to a security firm's page whose date does not match ours. - Two security firms' sites challenge automated clients, so their links are checked by hand. - Of the 22,146 on-chain contracts, 20,398 had verified source when last checked on 2026-10-19: 11,433 partial matches and 6,022 exact matches on Sourcify, plus 2,770 verified by an earlier check whose source was not recorded; 722 were not found on Sourcify, and 1,019 sit on chains no checker we use supports. Contracts added since are re-checked weekly. ## Questions people ask ### What is Trustblock? Trustblock is the open data layer for web3 security. It keeps one open security record per web3 project: which security firms reviewed its code, what they found, and which findings are still open. The records are free to read at trustblock.run and open to build on through the Trustblock API. ### How do I check if a crypto project or smart contract has been audited? Search the project's name, token or contract address on Trustblock. Its record lists every published audit with the firm, the date, the findings and their status, and a link to the firm's own report. If Trustblock has no record for a project, it holds no published audit for it; that says nothing about audits published elsewhere. ### Does an audit mean a project can't be hacked? No. An audit reviews specific code at a specific date. The code can change afterwards, some findings may stay open, and parts of a project may never have been reviewed. Trustblock shows each audit's date, scope and open findings so you can see what was covered and what wasn't. ### Where does Trustblock's data come from? From audit reports the security firms published, either submitted by the firm or collected by Trustblock from the firm's public pages. Severities are the firm's own classification. Trustblock does not rate or rank firms or projects. Firms can correct their records, and anyone can report an error. ### How can a project show its audits on its website? With the Trustblock project label: a small embed that states the date of the project's latest audit and the firm that did it, and links to its full record. It is free; pick what it shows and copy the code in the Playground or from the project's page. ### How can a security firm publish or manage its audits on Trustblock? A firm signs in to publish its reports, correct its record and get its widget for its own site. Firms with a public audit history already have a page on Trustblock, compiled from their reports; to take it over, a firm signs up and asks Trustblock to link that page to its account. ### Is Trustblock free? Reading records, the project label and the firm widget are free. Apps, wallets and explorers that show records in their own interface use the Trustblock API, which needs an API key (docs.trustblock.run). ### What counts as an audit on Trustblock? Trustblock counts audit reports: public reports in which a firm, a team assembled by an audit platform, or individual researchers other than the project's team review or verify its smart contracts as of a stated date. Each is labelled by type (audit, audit competition or formal verification) and keeps the firm's own word for it, such as "security review" or "security assessment". A fix review that names the earlier report counts once with it. Automated scans, penetration tests of apps, bug bounty programs and incidents can be part of a project's security record but are not counted as audits. Trustblock does not treat an audit as a certification: it covers the code as of its date. More: https://docs.trustblock.run/methodology/classify-security-reports ## Data - Sitemap index: https://app.trustblock.run/sitemap-index.xml - Audit page: https://app.trustblock.run/audit/{auditId} - Project page: https://app.trustblock.run/project/{projectSlug} - Security firm page: https://app.trustblock.run/auditor/{auditorSlug} ## API - Project security state: GET https://api.trustblock.run/v1/project/security, by domain, by slug, or by chain and address. An API key is required. - Documentation: https://docs.trustblock.run - Machine-readable description: https://api.trustblock.run/openapi.yml - an OpenAPI 3.0 document covering all six public routes, which is the whole public surface rather than a sample. ## Not covered here - Trustblock publishes no opinion on whether a project is safe to use, and nothing in this registry should be read as one. - Security firm metrics shown on security firm pages are computed from these audits and from third-party data sources, and are dated on the page itself. ## Plain-text pages - Each project page has a Markdown twin: https://app.trustblock.run/project/{projectSlug}.md (for example https://app.trustblock.run/project/aave.md). - Each security firm page has one too: https://app.trustblock.run/auditor/{auditorSlug}.md (for example https://app.trustblock.run/auditor/hacken.md). - A twin opens with the page's dated answer sentence, then lists the audit reports with their date, security firm and critical findings, and links back to the page.