Audit-to-deploy gap

Evidence summary #

Zellic audit window Feb 11-17 2025; USDf proxy upgrade occurred Feb 10 2025. Pashov report date Feb 17 2025. Audit appears simultaneous with or slightly after initial deploy — gap is close but uncertain direction. Scored yellow (not green) due to uncertainty about audit-then-deploy vs deploy-then-audit ordering.

Detail #

The USDf proxy was first deployed Jan 16 2025 (Admin Safe creation per Etherscan). The USDf proxy shows an upgrade transaction on approximately Feb 10 2025. The Zellic audit window is Feb 11-17 2025 — one day after the proxy upgrade. This suggests the audit may have captured a revised version. Pashov signed off Feb 17 2025. The Zellic report published March 7 2025 means a deploy-to-report gap of ~25 days. The concern is whether the Feb 10 2025 upgrade was the audited version or if code was deployed before the audit concluded. Without a public repo and commit SHA verification, the exact ordering cannot be confirmed. Scored yellow because the gap is borderline and uncertain.

Sources #

Methodology #

Measure the number of days between the audit report sign-off date and the mainnet deploy of the audited bytecode.

See the full factor methodology and distribution across all protocols →