> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cargotrading.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Audits and Bug Bounty at Cargo Finance

> Audit status of the Cargo vault contracts, operational audits of the stock, and how to report a vulnerability responsibly.

Cargo audits two things: the code that issues and trades shares, and the stock that backs them.

## Smart-Contract Audits

The contracts that mint, auction and hold value (the minting guard, the Genesis curve and the batch auction) will be independently audited **before they go live on mainnet**. No audit has been completed yet. Reports will be listed here as they are published.

| Auditor | Date | Scope | Report |
| :- | :- | :- | :- |
| Not yet appointed | — | Minting, Genesis curve, batch auction | Published here |

## Stock and Financial Audits

| Check | Who | Cadence |
| :- | :- | :- |
| Lot verification | Independent inspector (Vallis in the Genesis Vault) | Every lot |
| Stock report hash | Collateral manager | Weekly |
| Agreed-upon procedures on stock against shares | Independent accountant | Quarterly |
| Auction log review | Independent reviewer | Quarterly |
| Financial statements | Auditor, named on signing | Annual |

## Reporting a Vulnerability

A formal bug bounty with reward tiers has not launched yet. Until it does, we still want to hear from you and will credit responsible disclosures.

**1. Prepare**

Document the issue, the steps to reproduce it and its impact.

**2. Submit**

Email **[cargovaults@gmail.com](mailto:cargovaults@gmail.com)** with the subject line "Security". Do not post details publicly.

**3. Wait**

Give us time to triage and fix before any disclosure. We will confirm receipt and agree a timeline with you.

> [!NOTE]
>
> Never test against mainnet contracts or real funds. Use a local fork or a testnet.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.