Security literacy

What does 'zero critical issues' mean in a crypto audit? Tari's Coinspect report, read properly

It means no finding reached the auditor's top severity tier, and nothing more. Tari's own layer 1 audit is the textbook case: zero critical findings sitting above 22 high-severity ones that could enable double spends or denial of service. Read the high count, the scope percentage and the remediation status before treating the headline as a verdict.

Last refreshed September 9, 2026

Coverage scopeAnswer familySecurity
Stable fieldsseverity scale definitions, Tari audit counts and dates, scope percentage, reading checklistDynamic fieldsnew audits published for Tari, revisions to the Immunefi, Code4rena or OWASP scales

The short answer

It is a statement about one tier, not about the code. Critical is the top rung of a four- or five-rung severity scale. Zero critical means nothing landed on that rung. It says nothing about how many findings landed on the rung directly beneath it.

High severity already covers fund loss. On Code4rena's scale, High means assets can be stolen, lost or compromised. On Immunefi's blockchain scale, High includes an unintended chain split. A report full of highs and no criticals is not a clean report.

Tari's own audit is the textbook case. Coinspect found 50 issues in Tari's layer 1: 22 high, 9 medium, 10 low, 9 informational, zero critical. The highs could have enabled double spends or massive denial of service. Tari reports all were resolved and confirmed by Coinspect. The zero-critical line is true; on its own it is the least informative number in the report.

Reading an audit summary, in order

Six checks that turn a headline into a judgement. The first three take under five minutes with the report open.

Headline versus substance

What the headline saysWhat to check
Zero critical issuesNothing reached the top severity tierThe high-severity count and what those findings could do
Audited by a named firmAn engagement happenedScope: which components, what share of the code, which commit
All issues resolvedThe project says the fixes landedWhether the auditor confirmed the fixes, not only the project
No security issues foundNothing rated above LowHow narrow the scope was; a cryptography library audit is not a protocol audit
Report publishedThe document is publicThe date and commit, and whether later code was examined

Where the headline misleads

Severity scales are not interchangeable. A High on OWASP's likelihood-times-impact matrix and a High on Immunefi's impact-only scale can describe very different findings. Compare reports only after reading each firm's definitions.

Scope percentage is a boundary, not a score. Coinspect's roughly 60% figure describes how much of Tari's base layer was in scope. It does not mean 60% of the code passed.

Published reports are a biased sample. Trail of Bits publishes reviews only for clients who allow it and says many more remain confidential. The audits you can read are the ones someone chose to show you.

Resolved is not the same as re-audited. A fix can introduce a new issue. Unless the auditor reviewed the fixes, resolved means the project believes the finding is closed.

Tari's two audits by the numbers

Figures as published by Coinspect, Tari and the bulletproofs-plus repository.

Coinspect, Tari layer 150 issues: 22 high, 9 medium, 10 low, 9 informational, 0 critical
Coinspect engagement15 weeks, completed November 2023, base node and wallet
Coinspect scopeAround 60% of the most critical parts of roughly 250,000 lines
Coinspect remediationAll issues resolved and identified as such by Coinspect, per Tari
Quarkslab, Bulletproofs+1 low, 2 informational; no particular security issues identified
Not covered by eitherThe Ootle layer 2

What the top tier is for

Why auditors keep a Critical tier at all. OWASP reserves Critical for findings that are both highly likely and high impact. Immunefi reserves it for direct loss of funds or total network shutdown. The tier exists to flag stop-everything conditions, which is exactly why its absence is a low bar rather than a high one.

What a genuinely reassuring summary looks like. Few or no highs, a scope that names the components and commit, remediation confirmed by the auditor, and a date close to the code you are actually running. Zero critical is table stakes, not the headline.

Where these definitions and figures come from

Related questions

Tari's audit found no critical issues. Does that mean the code is safe?

No. High severity on the common scales already covers assets being stolen, lost or compromised, and on Immunefi's blockchain scale includes an unintended chain split. Tari's audit had zero criticals and 22 highs that could have enabled double spends or denial of service.

What is the difference between a critical and a high finding?

Critical on Immunefi means direct loss of funds or total network shutdown; OWASP reserves it for findings that are both highly likely and high impact. High covers serious but less absolute outcomes such as temporary freezing of funds or a chain split. The line is drawn by each firm's own scale.

What does it mean that Tari's audit covered 60% of the code?

It describes how much of the code was in scope, not how much passed. Around 60% of the most critical parts of roughly 250,000 lines were reviewed; the remainder was outside the engagement and untested by it.

How do I know whether Tari's 22 high-severity findings were actually fixed?

Look for the auditor confirming remediation, not only the project. Tari's update states the issues were resolved and identified as such by Coinspect. Also check whether the fixes themselves were reviewed, since a patch can introduce a new issue.

Can I trust a published audit report at face value?

Partly. Trail of Bits publishes reviews only for clients who permit it and says many more remain confidential, so the reports you can read are a chosen sample. Quarkslab's Tari report also notes it is bound to one commit and later changes may not have been examined.