Audit Reports
Axis publishes three independent smart contract reviews. Audit findings are useful evidence about a defined code snapshot, but an audit is not a warranty and does not cover every offchain strategy, custody, venue, operator, or legal risk.
Finding counts on this page are taken from the reports. Use the reports themselves as the authoritative source for exact scope, code revisions, severity definitions, dispositions, and auditor status.
V2 (current)
OpenZeppelin
July 2026
6db59ec
25 total: 0 critical, 2 high, 7 medium, 13 low, 3 informational
Contracts in scope:
USDxUSDxMarketMarketConfigStakedUSDxAxisV2Ids(shared identifier library, not an upgradeable contract)
All four in-scope V2 contracts are upgradeable behind proxies.
V1 (legacy)
The V1 contracts are the deprecating private-beta deployment on Plasma. See Contract Addresses.
Plainshift
January 2026
98849c5
9 total: 0 critical, 0 high, 1 medium, 3 low, 5 informational
Zellic
August 2025
845d765
10 total: 2 critical, 1 high, 4 medium, 3 low, 0 informational
Contracts in scope:
AxisUSDAxisUSDMintingSingleAdminAccessControlStakedAxisUSDStakedAxisUSDV2AxisUSDSiloStakingRewardsDistributorAxisUSDRateProvider
Confirm the scope and revision in each report before assuming a deployed contract was reviewed.
Scope exclusions
The reviews cover defined Solidity code and revisions. Zellic explicitly excludes the front end, infrastructure, and key custody. OpenZeppelin's V2 review states that custodian solvency and physical custody, offchain operator policy and pricing, and reentrancy from non-standard tokens are out of scope, and that there is no onchain oracle: settlement trusts the operator-signed minimum output amount. No report audits strategy execution, exchange solvency, custody operations, performance reporting, or legal structure.
What not to infer
These reports should not be summarized as "no outstanding critical or high findings" without reconciling the base revisions, remediation commits, deployed bytecode, and the dispositions recorded in each report.
For the V1 contracts, immutable or non-upgradeable characteristics can reduce one category of upgrade risk, but they do not remove privileged-role, configuration, operator, custody, strategy, or deployment risk. The V2 contracts reviewed by OpenZeppelin are upgradeable behind proxies, so upgrade-authority risk applies to them in addition to the above.
For the full onchain trust model, see Security Overview and Access Control.
Last updated