Skip to main content
DZap’s smart contracts are audited by independent firms. All reports are public.

​
Audit repositories

DZap Audits

Top-level repo for protocol audits across all DZap products.

ZappingContracts Audits

Per-version audit reports for the Fuse / Zap contract suite.

Audit Reports (legacy)

Older reports, still maintained at the legacy docs URL.

Smart Contract Addresses

Verify deployed contracts on each chain.

​
Audit partners

Specific firm names + report links land here as audits complete. Track the GitHub repos above for the latest.

​
Trust boundaries

​
Reporting a vulnerability

Email support@dzap.io with [SECURITY] in the subject. Include:
  • Description of the issue.
  • A proof-of-concept (if you have one).
  • Affected chain / contract / endpoint.
We acknowledge within 24h. Critical issues qualify for a bounty.

​
Operational checklist

For partners integrating DZap:
  • ✅ API keys server-only — never in browser code.
  • ✅ Verify webhook HMAC signatures (Trade API).
  • ✅ Use a session-scoped key for AI agent execution; rotate regularly.
  • ✅ Cap per-trade and per-day value at the application layer.
  • ✅ Whitelist tokens in consumer-facing apps.
Last modified on May 4, 2026