DEXignation has completed an external security audit by Beosin.
- Report No.: 202607031722 (July 3, 2026)
- Scope: 12 core + 4 trading contracts
- Result: 3 Medium / 2 Low / 3 Info — all Fixed
- Report + summary:
docs/audit/
Fixes were applied and verified before the final on-chain deployment
(0xdeed01–0xdeed16). The test suite covers the fixed behavior (255 passing).
Security fixes apply to the currently deployed mainnet contracts listed in
docs/deployments.md. Older, superseded deployments are not
maintained.
If you discover a security issue, please do not open a public issue. Report it privately so it can be triaged and, if necessary, mitigated before disclosure.
- Contact: security@dexignation.com
- Please include: affected contract/address, a description of the issue, reproduction steps or a proof-of-concept, and the potential impact.
- We aim to acknowledge reports promptly and will coordinate a disclosure timeline with you.
Update the contact address above to your monitored security inbox before publishing.
In scope:
- The deployed contracts in
docs/deployments.md - Logic that could lead to loss of funds, unauthorized ownership/records changes, bypass of the subname sale-lock, incorrect revenue distribution, or auction/market manipulation
Out of scope:
- Issues in third-party dependencies already covered by their own disclosures (e.g. OpenZeppelin, Chainlink)
- The private deployment tooling (not part of the on-chain attack surface)
- Frontend/client-only issues without an on-chain impact (report separately)
- Ownership: contracts are currently owned by a single EOA. Migration to a
multisig is planned; each contract is independently
transferOwnership-able without changing its deployed address. - Price oracle: registration pricing sources Chainlink POL/USD. Feed liveness and deviation are external dependencies.
- Payment tokens: only allow-listed ERC-20s (USDC, USDT) are accepted; the controller guards against fee-on-transfer shortfalls.