Skip to main content

Audits and Security

Review Nexus Mutual's audits, bug bounties, and initiatives to strengthen our protocol's security.

Audits​

Every security review of the Nexus Mutual smart contracts, newest first, with the code that was reviewed, the report, and the governance proposal that put the audited code on Ethereum mainnet. You can also review Nexus Mutual's GitHub, where these reports are hosted.

Asset oracle update — April 2026​

Support for reading the rETH/ETH ratio directly from the token, ahead of the Chainlink feed's deprecation.

  • Reviewed by: iosiro — reviewed as a change to already-audited contracts, so no standalone report was produced
  • Contracts: Pool.sol, AggregatorRETH.sol
  • Shipped: Governor proposal #3, executed 16 April 2026

Cover purchase signature update — January 2026​

An extra data field and a deadline added to the buyCoverWithRi signature.

  • Reviewed by: iosiro — reviewed as a change to already-audited contracts, so no standalone report was produced
  • Contracts: Cover.sol
  • Shipped: Governor proposal #2, executed 23 February 2026

RI cover changes — October 2025​

Support for selling cover backed by external reinsurance pools.

Protocol upgrade — August to October 2025​

A reimplementation of governance and claim assessment: the new Governor and Registry contracts, Assessments V3 and Claims V3.

  • Reviewed by: iosiro
  • Report: Nexus Mutual Protocol Upgrade Smart Contract Audit
  • Contracts: 23 files, including Governor.sol, Registry.sol, Assessments.sol, Claims.sol, Pool.sol, Ramm.sol, SwapOperator.sol, TokenController.sol, SafeTracker.sol, NXMaster.sol
  • Shipped: proposal #264, executed 29 October 2025, followed by the Registry deployment on 30 October 2025

RWI Vault — September 2025 to March 2026​

The ERC-7540 vault contracts used for real-world investments, reviewed across an initial audit and four follow-up changes.

Cover edits, limit orders and staking pool fix — March 2025​

Editable covers, the LimitOrders contract, and a fix to staking pool deposit extension.

Product pricing changes — January 2025​

A minimum price per product listing, removal of surge pricing, and a revised price bump ratio.

USD price feed oracle support — November 2024​

Support for Chainlink USD-denominated price feeds.

Long-term limit order — September 2024​

Long-lived limit orders for the SwapOperator.

Staking pool fixes and NXM batch withdrawal — August 2024​

Corrections to reward share accounting, prevention of deallocation when burning during the grace period, and system-wide batch withdrawal of NXM rewards.

CoverProducts refactor and total active cover fix — July 2024​

Extraction of the CoverProducts contract to resolve contract size limits, plus a correction to active cover accounting.

Swap Operator asset-to-asset — March 2024​

Direct pool asset swaps through CoW Protocol.

Safe Tracker — January 2024​

An ERC-20-style contract that values the assets held in the Advisory Board's Safe multisig. The Safe was used to manage the Mutual's Aave v3 loan, which has since been repaid.

Tokenomics — October to November 2023​

The Ratcheting AMM (RAMM), which introduced continuous on-chain NXM liquidity.

V2 — November 2022 to March 2023​

The full V2 protocol: the new cover, staking and assessment architecture.

  • Reviewed by: iosiro, across two audit rounds and a final retest
  • Report: Nexus Mutual V2 Audit
  • Contracts: all contracts under contracts/modules
  • Shipped: proposals #187 to #190, executed 9 March 2023

Emergency response — August 2021​

A rework of the emergency pause and contract upgrade mechanics.

Distributor — June 2021​

The distributor contract and factory, which let a third party buy cover on behalf of its own users.

Stacked risk, on-chain MCR and Swap Operator — May 2021​

Yield token cover, the move of MCR calculation on-chain, and the introduction of the Swap Operator.

Onboarding review — April 2021​

iosiro's familiarisation review of the protocol at the start of the engagement, covering the smart contracts, the distributor and the pricing API. Its purpose was to onboard the auditors rather than to assess a release, and it was not published.

Earlier audits​

  • Distributor contract, G0 Group, March 2021 — report
  • Claim payout contract upgrade, G0 Group, November 2020 — report
  • Pooled staking contract, G0 Group, June 2020 — report
  • Pre-launch audit, Solidified, April 2019 — report

Verifying an upgrade yourself​

Every upgrade listed above was executed by an on-chain governance proposal. To check one:

  • Proposals up to October 2025 were executed through the Governance contract at 0x4A5C681dDC32acC6ccA51ac17e9d461e6be87900. The ActionSuccess event carries the proposal ID, and NXMaster at 0x01BFd82675DBCc7762C84019cA518e701C0cD07e emits ContractUpgraded for each contract that was replaced.
  • From the V3 upgrade onwards, proposals are executed through the Governor at 0xcafea6063d4Ec6b045d9676e58897C1f0882Ca32, which emits ProposalExecuted, and Registry at 0xcafea2c575550512582090AA06d0a069E7236b9e emits ContractUpgraded.

Security​

Nexus Mutual works to ensure the smart contract system is safe and secure. Regular audits are an important part of maintaining the security of the smart contract system, but there are other approaches the Mutual takes to keep the protocol secure.

Bug bounty program​

Nexus Mutual works with Immunefi to manage a bug bounty program. On Immunefi, hackers secure DeFi contracts, save funds from theft, and get paid for responsibly disclosing vulnerabilities. We are able to secure the Nexus Mutual protocol through this program with Immunefi.

Through this program, whitehat hackers are incentivized to disclose vulnerabilities in the Mutual's smart contract system in exchange for payouts equal to the level of severity.

Smart Contracts and Blockchain

  • Critical | Up to $50,000 USD
  • High | Up to $25,000 USD
  • Medium | Up to $10,000 USD
  • Low | Up to $2,000 USD

Note: Bounties listed in USD but paid out in stablecoins.

Check out the bug bounty program on Immunefi for more details.