Before a single token was sold, the $TRT contracts went through an independent security audit. We treated it as a gate, not a formality: the presale did not open until every finding above the lowest severity was resolved. Here is an honest account of what happened.
Why we audited before launch, not after
Plenty of projects audit after they have already raised money. We think that is backwards. An audit that happens after the presale protects the team; an audit that happens before it protects the buyers. We chose the second.
What the auditors tested
The review covered the token contract, the presale contract, and the distribution logic that handles ETH rewards. The auditors examined the code from several angles, looking for the classes of bug that have historically drained real protocols.
- Reentrancy on every function that moves value.
- Access-control gaps — could any privileged function be called by the wrong address?
- Integer overflow and rounding errors in the reward math.
- Front-running and price-manipulation vectors during the presale.
- Upgradeability risks and admin-key exposure.
What they found
No critical or high-severity issues were found in the core value-handling logic. The auditors did surface a handful of medium and low-severity items, which is normal and healthy — a report with zero findings usually means the review was shallow.
“A clean audit is not one with no findings. It is one where every finding is understood and addressed before users are exposed to it.”
The changes we shipped
In response to the findings, we made several concrete changes before the presale opened:
- 1Tightened access control on the treasury withdrawal path so it can only ever route to the distribution contract.
- 2Added an explicit reentrancy guard to the reward-claim flow as defense in depth.
- 3Reworked the reward math to eliminate a rounding edge case that could, in extreme scenarios, leave dust unallocated.
- 4Documented every admin function and its intended caller, then verified those assumptions on-chain.
Where to read the full report
The complete audit report is linked from the docs and from the buy widget itself. We encourage everyone — not just the technically inclined — to at least skim the summary. Security is not a badge you earn once; it is a practice, and transparency is the first part of it.