All audits

Web3 · Penetration Testing

Tezos

softstack completed a development engagement for Tezos. Findings for this engagement are confidential and the report is available on request.

Key facts

Client
Tezos
Type
Penetration Testing
Chains
Tezos, Ethereum
Market cap
$349M as of 2026-10-27

About the project

Tezos is an open-source proof-of-stake blockchain for smart contracts and tokenized assets, with XTZ as its native token. It uses on-chain governance that lets stakeholders propose and vote on protocol upgrades, so the network can amend itself without hard forks. Tezos was first proposed in 2014 and its mainnet launched in 2018.

Methodology

Review process

  1. Scoping and threat modelling

    The commit hash is frozen and the attack surface is mapped: asset flows, trust assumptions, privileged roles and the external systems the code depends on.

  2. Automated analysis

    Static analysers sweep the full codebase to surface known weakness patterns, unreachable states and deviations from established conventions.

  3. Manual code review

    Independent engineers read the code line by line, concentrating on business logic, access control, arithmetic and the handling of external calls.

  4. Adversarial testing

    Property-based fuzzing and invariant tests attack the assumptions the protocol relies on, targeting states that ordinary unit tests never reach.

  5. Reporting

    Every finding is documented with a severity rating, its impact, the steps to reproduce it and a concrete remediation the team can act on.

  6. Remediation verification

    Submitted fixes are re-reviewed against the original finding, and the final report records the resolved state of each one.

FAQ

The deliverable for this engagement is covered by a confidentiality agreement, so the findings are not published. softstack can share the report on request where Tezos approves it.

Disclaimer

This audit represents a point-in-time security assessment of the reviewed codebase and is intended for informational purposes only. While Softstack applies industry-standard security review methodologies, no audit can guarantee the absence of vulnerabilities, bugs, or other security risks. This report does not constitute financial, legal, regulatory, or investment advice, nor does it endorse the project, its business model, products, or services. Security is an ongoing process, and we strongly recommend conducting a new assessment following any material code changes or at least every 6 months to address newly emerging threats, vulnerabilities, and ecosystem developments.