Is the code running today the code that was audited?

The 20 largest Ethereum DeFi protocols, checked contract by contract: which public audits cover each one, what is live onchain, and what changed since. Every result links to its source.

Early prototype. This is a first pass over 20 protocols to show what the full register will look like. Results are incomplete and some will be wrong. They will get much better as we fix the known limitations below and take feedback from protocols and auditors.

#ProtocolEthereum TVLContracts compared with audits

What counts as a match

The live code is identical to the audited code, or differs only cosmetically: comments, formatting, version strings.
Differences limited to launch-time setup or the constructor, with identical runtime logic.
Fixes for the audit's own findings, and changes a later public audit reviewed.
Formal verification of the live code.

What the other results mean

Changed since audit: the live logic differs from every public audit we found.
No public audit covers it: the contract is live and no located public report includes it in scope.
Can't verify yet: a report, repo or audited commit needed for the comparison isn't public or couldn't be recovered.

Known limitations and how we'll fix them

Reports that don't name the code version

Effect: contracts show as can't verify yet, even when they were audited.

Fix: recover the reviewed version from auditors' and contest repositories, match the file hashes many reports list, and ask protocols and auditors to confirm it.

Audited code kept private

Effect: there is nothing public to compare the live code with.

Fix: ask protocols to publish the reviewed version or a hash of it, and label these contracts clearly in the meantime.

Loosely described audit scope

Effect: a contract can show as not covered when an audit did review it.

Fix: read full scope appendices, and accept corrections with evidence from protocols and auditors.

Many cloned contracts

Effect: one unresolved template can add dozens of contracts to a count.

Fix: group clones under the implementation they copy, so each is resolved once.

Strict automated comparison

Effect: some differences may be classed more strictly than they deserve.

Fix: rebuild with the exact deployed compiler settings and double-check every result for the largest protocols.

A single snapshot

Effect: upgrades and new audits since the snapshot aren't reflected.

Fix: refresh every protocol monthly and show when each was last checked.

A changed or unaudited contract isn't necessarily unsafe. These results describe audit coverage, not code quality. Retired contracts are listed separately and left out of the counts.