Alto security record
As of 14 Oct 2026, Alto has 4 audit reports by 1 security firm on Trustblock; the latest is by Cantina, dated 26 Sep 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Alto Money: v1 | Security firm: Cantina | Date: | Scope: Not recorded. See the report | No open critical findings | Open · cantina.xyz |
| Alto Money: v1 Basemarket Changes | Security firm: Cantina | Date: | Scope: Not recorded. See the report | No open critical findings | Open · cantina.xyz |
| AltoMoney: Phaze Solo Review | Security firm: Cantina | Date: | Scope: Not recorded. See the report | No open critical findings | Open · cantina.xyz |
| Alto Money v1 | Security firm: Cantina | Date: | Scope: Not recorded. See the report | No open critical findings | Open · cantina.xyz |
Findings30
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 9 | 21 |
LowBorrow-token exclusion prevents forwarding DUSD rewardsAlto Money: v1 · Cantina · 26 Sep 2026Fixed
The report gives no description here.
Open the reportLowPermissionless collateral donations can front-run credit-account rotationAlto Money: v1 · Cantina · 26 Sep 2026Fixed
The report gives no description here.
Open the reportLowTerminal repayment can leave borrow shares that block credit-account rotationAlto Money: v1 · Cantina · 26 Sep 2026Fixed
The report gives no description here.
Open the reportLowZero-interest accrual emits events unlike the Mint marketAlto Money: v1 · Cantina · 26 Sep 2026Fixed
The report gives no description here.
Open the reportLowAdvanced fee strategy can pack fee values into smaller storage typesAlto Money: v1 Basemarket Changes · Cantina · 1 Jul 2026Fixed
The report gives no description here.
Open the reportLowAdvanced USM compatibility is not explicitly discoverableAlto Money: v1 Basemarket Changes · Cantina · 1 Jul 2026Fixed
The report gives no description here.
Open the reportLowLiquidation events could use the original liquidator for easier indexingAlto Money: v1 Basemarket Changes · Cantina · 1 Jul 2026Fixed
The report gives no description here.
Open the reportLowSupported market removal could avoid external validation callsAlto Money: v1 Basemarket Changes · Cantina · 1 Jul 2026Fixed
The report gives no description here.
Open the reportLowCurrent guardian can indefinitely block its own replacement by revoking pending guardian transitionsAltoMoney: Phaze Solo Review · Cantina · 18 Jun 2026Fixed
The report gives no description here.
Open the reportLowDust share positions can prevent immediate cleanup-only full unwind during reallocationAltoMoney: Phaze Solo Review · Cantina · 18 Jun 2026Fixed
The report gives no description here.
Open the reportShow 10 more
Lowerc4626Mint() and erc4626Withdraw() do not sweep leftover tokens unlike USM counterpartsAltoMoney: Phaze Solo Review · Cantina · 18 Jun 2026Fixed
The report gives no description here.
Open the reportLowLost asset recovery mechanism and its accounting implications should be documented more thoroughlyAltoMoney: Phaze Solo Review · Cantina · 18 Jun 2026Fixed
The report gives no description here.
Open the reportLowmaxWithdraw() and maxRedeem() may overstate liquidity for paused marketsAltoMoney: Phaze Solo Review · Cantina · 18 Jun 2026Fixed
The report gives no description here.
Open the reportLowRe-enabling a removed market double-counts stale vault supply and inflates accountingAltoMoney: Phaze Solo Review · Cantina · 18 Jun 2026Fixed
The report gives no description here.
Open the reportLowSupply to markets proceeds with stale interest data when interest accrual is blockedAltoMoney: Phaze Solo Review · Cantina · 18 Jun 2026Fixed
The report gives no description here.
Open the reportLowVault accounting assumes it is not configured as a borrow market fee recipientAltoMoney: Phaze Solo Review · Cantina · 18 Jun 2026Fixed
The report gives no description here.
Open the reportLowCode quality improvementsAlto Money v1 · Cantina · 8 Dec 2025Fixed
The report gives no description here.
Open the reportLowIncomplete state reset during contract seizureAlto Money v1 · Cantina · 8 Dec 2025Fixed
The report gives no description here.
Open the reportLowInsufficient minimum amount validation in asset purchaseAlto Money v1 · Cantina · 8 Dec 2025Fixed
The report gives no description here.
Open the reportLowManual decimal specification may lead to configuration errorsAlto Money v1 · Cantina · 8 Dec 2025Fixed
The report gives no description here.
Open the reportShow 1 more
LowMissing events for configuration tracking in fee and price strategiesAlto Money v1 · Cantina · 8 Dec 2025Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="alto"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us