Security Audits Are In

"You haven't finished your audits yet."

Since our public beta in May, that has been the single most common piece of feedback we've received. It was fair. Today it no longer applies.

Phase 1 of our security programme is complete. Two independent firms spent the last two months reviewing Surge, and both reports are now public in full, every finding, every severity rating, every status.

• surge.credit/security-audits - scope, summary and links
• github.com/surgecredit/audits - the raw reports

Why a full-stack review, and not one audit

Surge isn't one system. It's two, and they fail in completely different ways.

Your Bitcoin sits in a Taproot vault on Bitcoin L1, enforced by Bitcoin script, with signatures produced by a Distributed Custody Network where no single party holds a key. That's a custody and cryptography problem. It needs someone who lives in Bitcoin script and MPC.

The credit itself, the accounting, the rates, the liquidations, and the auctions runs as smart contracts on Base. That's an economic-logic problem. It needs someone who breaks lending protocols for a living.

No single firm is genuinely excellent at both. So we hired two, and scoped the review to cover the whole stack: Bitcoin, the DCN, the relayers, and the EVM contracts.

Bitcoin, DCN and relayers ( Rearden Code )

Brandon Black (@reardencode) of Ngu Services reviewed the Bitcoin-facing core: the on-chain Line of Credit contract, the relayer that coordinates application services, and the DCN signer software.

The signer software is built on cb-mpc, the open-source MPC library Coinbase publishes and uses for its own custody wallets. We didn't want to be the ones inventing threshold signing from scratch.

The final report, dated 22 July 2026, concludes that after prompt remediation of the initial findings, the system is "free of material defects in security or suitability" within the audit scope.

Three properties matter most to a borrower, and all three were reviewed:

• Your collateral can't move on someone else's say-so. Each signer independently validates the terms of a line of credit before participating in a signing ceremony. A single compromised signer cannot take an unauthorised action with collateral.
• You can walk away. The on-chain contract lets a borrower unilaterally reclaim collateral if the Surge-coordinated quorum is unavailable for a period after the term expires. If we disappear, your Bitcoin doesn't.
• The plumbing is boring on purpose. JWT auth with granular user-level authorisation, minimal stored sensitive data, database audit logs held separately from the application server, and an additional cryptographic signature from the user's own key required for sensitive operations.

Those were our claims for months. Now someone else's name is on them.

EVM smart contracts on Base ( CredShields )

CredShields audited the lending market contracts deployed on Base - VaultManager, LiquidityPool, PositionNFT and AuctionHouse. The audit ran 24 June to 13 July 2026, with a retest on 29 July and publication on 5 August.

• Critical: 0
• High: 3
• Medium: 11
• Low: 12
• Informational: 8
• Total: 34

At retest, 30 of 34 were confirmed fixed, including all three High-severity findings. The remaining four are documented as accepted risk.

No user funds were affected by anything in either report.

The three High findings, in plain language

1. A liquidation threshold was mis-inverted (Legacy Position Only). A conversion meant to translate loan-to-value into a collateral ratio was being applied to a legacy value that was already a collateral ratio. The effect was a liquidation trigger that dropped from a 120% collateral ratio to roughly 83%, a position could have gone deeply underwater before anything fired, socialising bad debt to lenders. The exposed surface was legacy positions worth approximately $200. Fixed: the inversion now applies only to new-market thresholds.

2. Dust deposits could jam the queue. Fixed-market operations iterate an internal depositor queue. Because deposits were permissionless and unbounded, anyone could spam dust entries until that iteration ran out of gas, taking every fixed-market operation with it, including liquidation settlement. A denial-of-service on liquidations is not a cosmetic bug. Fixed.

3. Expired loans could reach a dead state. A healthy loan that hit expiry could end up neither repayable, nor withdrawable, nor liquidatable, funds stuck with no path out for either side. Fixed.

The four we didn't fix

This is the part most announcements leave out, so here it is directly.

Four findings, two Medium (M010, M011), and two Low (L009, L012) were formally accepted as risk rather than remediated in this cycle. They sit inside admin capability in the DCN operational model, where off-chain policy already constrains the behaviour, and fixing them now would have introduced more surface than it removed.

You don't have to take our word for that judgement. Every one of them is in the report with its ID, severity, description and status. Read them and form your own view and if you think we called one wrong, we'd genuinely like to hear it.

On AI, since everyone is asking

We use AI extensively in our own security work. It's fast, it's tireless, and it's very good at spotting whole classes of bug that used to take a senior engineer a week to find. That capability cuts both directions, the same tools are being pointed at production DeFi code by people who have no intention of filing a report, and the industry is learning that the hard way right now. It's a large part of why we treated this as urgent rather than as a box to tick.

But finding a bug is the easy half. What made this system materially safer was two experienced security teams, with their own tooling and their own scars, accountable for a signed report and for a remediation that had to survive a retest. AI gave us speed. Humans gave us judgement and accountability. A serious security posture needs both, and anyone telling you one replaces the other is selling something.

What an audit is, and what it isn't

An audit is a point-in-time review of a defined scope. It reduces risk. It does not eliminate it, and it is not a guarantee.

What we can commit to is the process around it. Every meaningful change to the contracts or the signing infrastructure gets reviewed, and every report goes into the same public repository, whatever it says. We're calling this Phase 1 because there will be a Phase 2.

Bitcoin lending has been a black box for a decade. Every failure in the category came from the same place: you couldn't see what was happening to your coins until it was too late to do anything about it. The only credible answer we know is to publish everything and let you check.

So, check.

• Reports: surge.credit/security-audits
• Repository: github.com/surgecredit/audits
• Live protocol data: earn.surge.credit
• Walkthrough with Yash and Michael: youtu.be/2vmIbiOZ3xo