Audits are historical snapshots, not guarantees of current safety or frontend integrity.
Tornado Cash swirlTORNADO CASH
Home / Security & audits
Evidence, not assurances

Security & published audits

The links below were reviewed on 9 November 2026. Official documentation is available through GitBook and its GitHub source. Historical audit availability and scope do not guarantee current safety.

Source and documentation

GitHub: tornadocash Historical organization; repositories include archived code. ↗ Documentation Official GitBook documentation for protocol and governance material. ↗ Documentation index Archived GitHub table of contents on the English branch. ↗

Published audit PDFs

Classic dApp audit Decurity report; historical scope; direct TLS check failed. PDF Anonymity mining recheck ABDK smart-contract review, historical scope. PDF Anonymity mining final audit ABDK review, historical scope. PDF

Security notices and reporting

Current security notices will be published on this page. A dedicated vulnerability-reporting contact is being confirmed; until it is published, do not send sensitive vulnerability details through unofficial social accounts or public channels.

Security contact: Pending operator confirmation. This placeholder must be replaced before production launch.

Limits of published material

  • They do not cover every deployment, UI fork, dependency, relayer, bridge or later governance change.
  • They do not guarantee freedom from undiscovered vulnerabilities or operational compromise.
  • They do not resolve sanctions or other jurisdiction-specific legal restrictions.
Recommended verification: compare contract addresses against multiple independent sources, inspect bytecode and source history, check report scope and commit hashes, and obtain qualified legal advice where needed.