Changelog

​

Every report is typed

• Each published report has a kind, and each audit report a type: audit, audit competition or formal verification. How Trustblock classifies security reports
• Penetration tests of off-chain systems, automated scans and named re-audit versions are not counted as audit reports. What is not an audit
• On the record today: 9,797 audit reports, 59 security firms, 6,605 projects. All projects, A to Z

​

One severity scale across firms

• 4,268 findings that their firms graded as gas, QA or best practice are marked Informational. Informational findings are listed on the page and never counted as open. Aave v3 findings
• Findings that firms mark acknowledged are labelled “Acknowledged” and kept apart from fixed ones. Beta v1.9.0

​

The record on contract pages

• The Etherscan card answers for contracts on 26 explorers run by Etherscan, checked on 19 October. Explorer cards
• Blockscout’s Trustblock widget is enabled on 7 chains: Ethereum, OP Mainnet, Polygon, ZKsync Era, Base, Arbitrum One and Scroll. Blockscout card
• The card also reads “Verified source. Powered by Etherscan.io APIs” on Etherscan contracts and “Verified source” on Sourcify ones. Explorer cards

​

Playground: three embeds with code you can copy

• The project label, the security firm widget and the contract page card each have a tab with the embed code and a live preview. Playground
• The label has layouts (standard, compact, card), light, dark and auto themes, sizes, shapes, accents and up to five facts of your choice. Show your record on your site
• The label is also an image (label.svg), for READMEs and docs hosts that run no scripts. The label as an image
• The security firm widget shows a firm’s figures, with options for the figures, layout and theme. Security firm widget

​

Pages

• Project pages show the record in sections (Audits, Findings, Incidents, Contracts) and each project has a contracts page. Aave
• Firm pages carry the firm’s figures, its chains, its reports by project and a “Request an audit” link to the firm’s own website. Certora
• The security firms list is A to Z on one page. Security firms
• Firms can claim their profile with an email on the firm’s domain. Claim a profile

​

API and docs

• Audits in the public project route carry optional fields: kind, auditType, firmTerm, versionOf, seriesId and includesFormalVerification. Security Data API
• The OpenAPI file is served at one address. openapi.yml
• New docs pages: the classification method, a guide to showing your record, and the list of Aave v3 on Ethereum audits per reserve. Aave v3 on Ethereum
• llms.txt states the record and where to start. llms.txt

​

Incidents

• Incidents are attached only when they match the project by contract address, and amounts follow DefiLlama and rekt.news where they agree. Incident rule on the card

​

Pages under load

• Pages and public fetches refresh once a day, and an audit or firm change refreshes the pages it touches. Security firms
• The API’s search and list routes have page-size caps, and pages ask a busy API again instead of failing. Playground

​

20 October

• Reports are typed, and the reports that are not audits are out of every count. Classification method
• A report’s line states its type and the firm’s own term for it, for example “Audit · firm’s term: security review”. Versions and series
• New list: Aave v3 on Ethereum, audits per reserve. Aave v3 on Ethereum

​

19 October

• 4,268 findings moved to Informational. Aave
• The header Search button does nothing on an empty field, instead of opening a results page for “undefined”. Projects
• The security firms list is A to Z; contract lines read “Verified source. Powered by Etherscan.io APIs”. Security firms

​

14 October

• The project label shows the project’s three strongest facts and offers more facts, layouts and an image form. Show your record on your site
• Project pages show the record in sections, and each audit has its own page. Aave
• Informational findings are listed and never counted. Aave
• Firms can claim their profile. Claim a profile
• The Playground’s tabs switch in the browser, and the project and firm fields suggest names as you type. Playground
• llms.txt carries the record framing, the FAQ answers and what each page’s first sentence states. llms.txt
• New docs guide: show your record on your site. Guide

​

13 October

• Firm pages have a “Request an audit” link to the firm’s website. Certora
• The security firm widget has options (figures in order, layout, theme), and the Playground’s firm field suggests firms. Security firm widget
• Project, audit and firm pages open with a dated answer sentence, which is also their meta description. Aave
• Only the latest changelog page is indexed by search engines. Beta v1.9.0

​

11 October

• The app calls firms “security firms” in the header, footer, list, sign-up and project records. Security firms
• The home page opens with the projects table. Projects
• One line describes Trustblock everywhere: “The open data layer for web3 security.” Introduction
• A firm’s own page can carry the line “Compiled by Trustblock from public reports” when Trustblock keeps the profile. Certora

​

10 October

• “Show this on your site”: a label configurator on the project page, with a live preview. Aave
• A firm that is no longer active says so on its page. ack3
• The firm widget shows the same value figure as the firm page. Security firm widget

​

9 October

• Firm pages carry figures computed by one method. Security firms
• 15 more Etherscan mainnets are supported chains. Supported chains
• Off-chain scopes read in plain words, and firm pages show a chain bar. Certora
• Incidents read “Incident” on project pages, the dashboard and the card. Explorer cards
• Acknowledged critical findings are amber and read “not fixed”. Explorer cards

​

8 October

• The header has one set of links and the footer one shared footer on the public pages. Projects
• Security firms are listed A to Z on one page. Security firms
• The Playground has a code block per embed, and the label words are aligned: no bare “Audited”, a default “Last audit” line. Playground
• Project pages open with a record head. Aave

​

7 October

• Project and audit sitemap entries carry dates. Projects

​

6 October

• The label has options (variant, colour, mode, hide-not-found) and the Playground has a card tab. Labels Widget

​

5 October

• One public Playground with three tabs (project label, security firm widget, explorer card). Playground
• Hijacked or parked project websites are no longer shown on cards and pages. Projects
• The Privacy page names the service providers the sites use. Privacy

​

3 October

• XRPL and 10 more Etherscan chains are supported. Supported chains
• The developer dashboard shows your key, a “Test my key” button and your last calls. Security Data API
• Terms and Privacy answer on app.trustblock.run. Terms of Use

​

2 October

• The audits, firms and projects Trustblock quotes use one definition. Classification method
• Both explorer cards carry a contract line when an audit’s scope names the address. Explorer cards
• Trustblock-managed profiles are listed on /auditors, each labelled as managed by Trustblock. Security firms

​

1 October

• Twelve Cosmos-ecosystem chains are supported. Supported chains
• The widget became the free label: no account, no key. Labels Widget

​

30 September

• Findings can be recorded as acknowledged, labelled on project pages and in the API. Beta v1.9.0
• The card text is shorter and says “No audit on Trustblock” when there is none. Explorer cards
• Projects may have no chain (“Chain not stated”). Beta v1.9.0
• Sign-up asks who you are first, then shows the shortest form for that role. Beta v1.9.0
• Pages ask again when the API answers that it is busy. Beta v1.9.0

​

25 to 29 September

• Findings carry the firm’s own status word beside the Trustblock status. Beta v1.9.0
• The project page counts and lists the findings that still stand. Aave

​

20 to 24 September

• The OpenAPI file is served from the API domain and checked in the build. openapi.yml
• llms.txt is served from dated catalogue counts. llms.txt
• The Blockscout card can say a project has been hit by a recorded incident. Blockscout card
• A card that fails says so, instead of reading “no audit”. Explorer cards

​

8 to 21 September

• The Etherscan card’s verdict is scoped to the audit it comes from. Explorer cards
• A lookup that finds nothing no longer costs an API credit. Security Data API