Who has audited the contracts? Which firms?

Who has audited the contracts? Which firms?

Smart contract audits are a core part of the security posture for any serious on-chain lending platform, and the right way to answer "who audited this" is with specifics: named firms, dated reports, and defined scope, published where anyone can read them.

For the current, authoritative list of audit firms, report dates, and the specific contracts and scope each audit covered, refer to Rekord's official documentation and security disclosures rather than relying on a general statement here, since audit coverage is updated as new audits are completed and as contracts evolve. A single blog FAQ is the wrong place to pin a list that needs to stay current; the security or documentation section is where it's kept accurate.

What's worth understanding generally is how to read an audit rather than just count them. The number of audits matters less than their scope (which contracts were actually reviewed, and were any critical components left out), their recency (an audit of an older version doesn't cover code changed since), the reputation and track record of the firms involved, and whether the findings and the team's remediations were published rather than just the fact that an audit happened. A meaningful audit disclosure includes the report itself, not just a logo.

It's also worth knowing what audits do and don't provide. An audit substantially reduces the risk of known vulnerability classes and design flaws, but no audit guarantees code is bug-free, which is why layered security, audits plus formal verification where applicable, bug bounties, conservative parameters, and isolated-market containment, matters more than any single audit. Rekord's use of a small, immutable, widely-audited base primitive (Morpho Blue) is part of that layered approach, since the base contract itself carries extensive independent audit history.

For the specific firms and reports, see Rekord's official security documentation.