Jito security record
As of 9 Nov 2026, Jito has 1 audit report on Trustblock, by Certora, dated 13 Jan 2025. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits4
Newest first
| Report | Security firm | Date | Scope | Critical findings | Source |
|---|---|---|---|---|---|
| Jito Tip Router | Security firm: Certora | Date: | Scope: Not recorded; see the report | 6 critical findings, fixed | GitHub ↗ |
| Jito Interceptor Includes formal verification | Security firm: Certora | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Jito Restaking V2 Includes formal verification | Security firm: Certora | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Jito Restaking V1 Includes formal verification | Security firm: Certora | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
Findings51
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 6 |
| High | 0 | 0 | 8 |
| Medium | 4 | 1 | 9 |
| Low | 12 | 0 | 11 |
CriticalBallot Box can be DoS-ed by filling it up with fake ballotsJito Tip Router · Certora · 13 Jan 2025Fixed
The report gives no description here.
Open the reportCriticalBallot’s weight for previous vote doesn’t decrement on vote change, allowing attackerJito Tip Router · Certora · 13 Jan 2025Fixed
The report gives no description here.
Open the reportCriticalReward distribution might be skipped to some operators during routingJito Tip Router · Certora · 13 Jan 2025Fixed
The report gives no description here.
Open the reportCriticalSnapshot can be created for future epochs, assigning wrong stake weightsJito Tip Router · Certora · 13 Jan 2025Fixed
The report gives no description here.
Open the reportCriticalSnapshotting can’t be completed if empty vault-operator delegations existJito Tip Router · Certora · 13 Jan 2025Fixed
The report gives no description here.
Open the reportCriticalVoting can be done after routing started, leading to a DoS for the routerJito Tip Router · Certora · 13 Jan 2025Fixed
The report gives no description here.
Open the reportHighBase router resumes with wrong rewards, distributing low amounts for operatorsJito Tip Router · Certora · 13 Jan 2025Fixed
The report gives no description here.
Open the reportHighCooldown end time might overflowJito Interceptor · Certora · 13 Dec 2024Fixed
The report gives no description here.
Open the reportHighIncorrect Asset Unstaking Logic Leads to Over-UnstakingJito Restaking V2 · Certora · 11 Nov 2024Fixed
The report gives no description here.
Open the reportHighZero Supply States Can Permanently Break VRT: Token RatioJito Restaking V2 · Certora · 11 Nov 2024Fixed
The report gives no description here.
Open the reportShow 10 more
HighDelayed Vault Updates do not Properly Account for Multiple EpochsJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportHighFee Collection Inaccuracies and Inconsistencies in Vault Reward SystemJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportHighPremature State Transition in SlotToggle Deactivation ProcessJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportHighToken Denomination Mismatch in VRT Reserve CalculationJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportMediumrestaking_config isn’t verified, allowing to supply a fake accountJito Tip Router · Certora · 13 Jan 2025Fixed
The report gives no description here.
Open the reportMediumMax fee bps is not applied when updating the deposit stake authorityJito Interceptor · Certora · 13 Dec 2024Fixed
The report gives no description here.
Open the reportMediumPrecision Loss in Fee Calculation Due to Multiple Integer DivisionsJito Interceptor · Certora · 13 Dec 2024Fixed
The report gives no description here.
Open the reportMediumInconsistent Token Program Usage and Validation Creates Potential VulnerabilitiesJito Restaking V2 · Certora · 11 Nov 2024Fixed
The report gives no description here.
Open the reportMediumMissing Maximum Bounds Validation in Fee Rate ControlsJito Restaking V2 · Certora · 11 Nov 2024Fixed
The report gives no description here.
Open the reportMediumFee Calculation is not in Favor of the ProtocolJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportShow 10 more
MediumInconsistent and Unchecked Basis Points (BPS) ValuesJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportMediumInconsistent Zero-Value HandlingJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportMediumOverflow Risk in 64-bit CalculationsJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportLowRouter does one less iteration than it shouldJito Tip Router · Certora · 13 Jan 2025Fixed
The report gives no description here.
Open the reportLowLack of validation might allow using a stake pool not allowed by the programJito Interceptor · Certora · 13 Dec 2024Fixed
The report gives no description here.
Open the reportLowInconsistent Epoch Calculation MethodsJito Restaking V2 · Certora · 11 Nov 2024Fixed
The report gives no description here.
Open the reportLowVaultStakerWithdrawalTicket Uses Suboptimal PDA Address VerificationJito Restaking V2 · Certora · 11 Nov 2024Fixed
The report gives no description here.
Open the reportLowAlignment Issues in Structures used with BytemuckJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportLowFaulty VRT Mint Parameters in Vault InitializationJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportLowIncomplete Admin Reset in SetAdmin FunctionJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportShow 4 more
LowSimplification of WithdrawAssets Instruction ImplementationJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportLowUnnecessary call in MintTo InstructionJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportLowUnrecoverable Error Handling Across the CodeJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportLowUnsafe Handling of Mint in WithdrawAssets InstructionJito Restaking V1 · Certora · 19 Sep 2024Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="jito"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us