Documentation
Audits.
Housd commissions independent security reviews of its smart contracts before production deployment.
Reports are published here in full, including the findings raised and their remediation status.
TECHFUND
PositiveTECHFUND conducted a two-round security review of the HOUSD vault contracts, covering NAV accounting, oracle and proof-of-reserves integration, governance, and production deployment configuration.
- 1st report
- July 23, 2026
- 2nd report
- July 28, 2026
Severity summary
The first report identified three findings across NAV accounting and production deployment configuration. Each was remediated and re-reviewed, and the second report closed with no open findings at any severity level.
| Severity | 1st report | 2nd report |
|---|---|---|
| Critical | 0 | 0 |
| High | 0 | 0 |
| Medium | 1 | 0 |
| Low | 2 | 0 |
| Informational | 0 | 0 |
| Total | 3 | 0 |
Scope
The review covered the vault, oracle, proof-of-reserves, and governance contracts, together with the production deployment scripts:
- src/HousdVault.sol
- src/HousdOracle.sol
- src/HousdPorFeed.sol
- src/HousdGovernance.sol
- src/interfaces/*
- script/Deploy.s.sol
- script/DeployPorFeed.s.sol
Remediation
All three findings carry a status of Fixed. The medium-severity finding concerned deployed capital being double counted toward NAV when a custodian returned funds by a direct ERC-20 transfer rather than the dedicated return path. The two low-severity findings covered an unenforced six-decimal asset invariant at vault initialization and unvalidated governance configuration in the production deployment script.
Fixes were implemented and independently re-verified before the second report was issued.
Full descriptions, proofs of concept, and mitigations for each finding are documented in the linked report.
Methodology
Findings are rated using the OWASP Risk Rating Methodology, which derives an overall severity from the estimated impact and likelihood of each issue.
Independent audits complement, rather than replace, internal review. Housd also maintains continuous static analysis and symbolic execution over the contract suite.