> For the complete documentation index, see [llms.txt](https://jpydf.gitbook.io/jpy-defi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jpydf.gitbook.io/jpy-defi/technical-information/audits-and-bug-bounty.md).

# Audits & Bug Bounty

This page shows the current status of JPY DeFi's audit reports, bug bounty, and vulnerability-reporting channel.

## Audits

JPY DeFi is based on Liquity v2 but has Core differences and its own layers. Each audit below is a scoped source review, not a guarantee of safety for all code, live configuration, or future changes.

### Liquity v2

Between August 2024 and October 2025, Liquity v2 was audited by ChainSecurity, Dedaub, Coinspect, and Recon, formally verified by Certora, and reviewed in a Cantina audit competition. The reports are listed on Liquity's [Technical Docs & Audits](https://docs.liquity.org/v2-documentation/technical-docs-and-audits) page.

### Chain Defenders

[Chain Defenders](https://www.chaindefenders.xyz/) is a security firm that provides smart contract audits and development. It completed a review of the JPYdf-specific contracts and issued a report dated August 2026 (JPYDF Security Review). Within the reviewed scope, the report lists 1 High, 3 Medium, 7 Low, 8 Informational, and 2 Gas findings; 10 are Fixed and 11 are Acknowledged.

It then completed a review that included the features added or changed after that review, and issued a report dated August 2026 (JPYDF Enhancement Security Review). Within the reviewed scope, the report lists 2 Medium and 3 Low findings; four are Fixed and one is Acknowledged.

### Guardian

[Guardian](https://guardian.security/) is a digital asset security firm that provides smart contract audits and runs bug bounties and security contests. In its audits, two teams review the same scope in parallel.

Guardian has completed its review of the JPYdf-specific changes made after Chain Defenders' reviews and issued an updated report dated October 9, 2026. We have reviewed and approved the report. Within the reviewed scope, there were no Critical, High, or Medium findings; 17 findings are Resolved and four are Acknowledged.

## Bug bounty

The [JPYdf Bounty Contest on Guardian Defender](https://defender.guardianaudits.com/contests/01a12f39-c393-718a-ae22-adcc67dbc600) is active. Its scheduled submission period is **October 14, 2026, 08:27 UTC to November 13, 2026, 22:59 UTC**. Check the contest page for the current status and any schedule changes.

For vulnerabilities in code that JPY DeFi has not changed from Liquity v2 and that also reproduce in Liquity's original code, refer to the [Liquity official Bug Bounty](https://docs.liquity.org/v2-documentation/bug-bounty).

## Reporting vulnerabilities

Use **Submit Issue** on the Guardian contest page to report an in-scope finding.