Two contract audits.
Both check the smart-contract code at a date. Neither checks the gold.
- CertiK, 7 Apr 202616 findings: 12 resolved, 2 mitigated through multisignature administration, 2 acknowledged. No critical or major findings.
- Cyfrin, version 2.0, 10 Oct 20251 medium and 5 low findings, all resolved. No critical or high findings.
- Not in scopeThe reserve, the title and the company’s finances.
CertiK reportCyfrin report
Admin powers.
The contract is centrally controlled.
- PowersUpgrade, mint and burn, freeze, blacklist, force transfers and run redemptions (CertiK).
- CyfrinCalls the protocol deliberately centralised, and leaves that outside its scope.
- Your privacyDon’t put personal delivery details in public on-chain fields.
Aurum Safeguard.
A reserve of GGBR, 10% of minted supply, set aside for losses from a breach of the Goldfish protocol.
- Not coveredThird-party platforms, lost keys and phishing.
- BalanceCan change. It is public on Etherscan.
Safeguard wallet
Liquidity.
The company describes stress tests, liquidity simulations and DEX and CEX price monitoring.
These are stated practices. They don’t guarantee a price, or that any amount can be sold at any time.
Bug bounty.
Found a flaw in the contract or the app? Report it privately, with steps to reproduce.
- Critical
- $10,000 to $250,000
- Major
- $1,500 to $50,000
- Medium
- $500 to $5,000
- Low
- $50 to $500
- Out of scopeSocial or physical attacks, spam, denial of service, brute force, third parties, known issues and test systems.
Rewards are at the program’s discretion and depend on severity. Read its conditions before you test.
Report privately
Your part.
An audit can’t protect a wallet. These steps can.
- Check the addressBefore every approval.
- Recovery phraseKeep it private and offline.
- Familiar namesAre not proof. The contract address is.
- Other platformsHave their own risks and rules.
The official token