Audits
XDAO smart contracts have undergone an independent security audit. The audit reports are public, and anyone can review them.
We care about the security of our contracts, so we audit all smart contracts, including modules.
Upgradeability
The factory and the core DAO contracts carry no proxy and cannot be upgraded: once deployed, their code is fixed. Several peripheral modules, among them the launchpad, vesting, Merkle distributor, subscription and document modules, are deployed behind upgradeable proxies. Their proxy addresses are published in the repository's OpenZeppelin manifests and the admin role can be read on-chain; that role is held by the project and is moving under a timelocked multisig.
On TON and on Solana the contracts and programs are upgradeable, and the upgrade authority is held by a multisig rather than by a single key.
Audit reports are available on GitHub: