It means no finding reached the auditor's top severity tier, and nothing more. Tari's own layer 1 audit is the textbook case: zero critical findings sitting above 22 high-severity ones that could enable double spends or denial of service. Read the high count, the scope percentage and the remediation status before treating the headline as a verdict.
Last refreshed September 9, 2026
| Coverage scope | Answer family | Security | |
|---|---|---|---|
| Stable fields | severity scale definitions, Tari audit counts and dates, scope percentage, reading checklist | Dynamic fields | new audits published for Tari, revisions to the Immunefi, Code4rena or OWASP scales |
It is a statement about one tier, not about the code. Critical is the top rung of a four- or five-rung severity scale. Zero critical means nothing landed on that rung. It says nothing about how many findings landed on the rung directly beneath it.
High severity already covers fund loss. On Code4rena's scale, High means assets can be stolen, lost or compromised. On Immunefi's blockchain scale, High includes an unintended chain split. A report full of highs and no criticals is not a clean report.
Tari's own audit is the textbook case. Coinspect found 50 issues in Tari's layer 1: 22 high, 9 medium, 10 low, 9 informational, zero critical. The highs could have enabled double spends or massive denial of service. Tari reports all were resolved and confirmed by Coinspect. The zero-critical line is true; on its own it is the least informative number in the report.
Six checks that turn a headline into a judgement. The first three take under five minutes with the report open.
| What the headline says | What to check | |
|---|---|---|
| Zero critical issues | Nothing reached the top severity tier | The high-severity count and what those findings could do |
| Audited by a named firm | An engagement happened | Scope: which components, what share of the code, which commit |
| All issues resolved | The project says the fixes landed | Whether the auditor confirmed the fixes, not only the project |
| No security issues found | Nothing rated above Low | How narrow the scope was; a cryptography library audit is not a protocol audit |
| Report published | The document is public | The date and commit, and whether later code was examined |
Severity scales are not interchangeable. A High on OWASP's likelihood-times-impact matrix and a High on Immunefi's impact-only scale can describe very different findings. Compare reports only after reading each firm's definitions.
Scope percentage is a boundary, not a score. Coinspect's roughly 60% figure describes how much of Tari's base layer was in scope. It does not mean 60% of the code passed.
Published reports are a biased sample. Trail of Bits publishes reviews only for clients who allow it and says many more remain confidential. The audits you can read are the ones someone chose to show you.
Resolved is not the same as re-audited. A fix can introduce a new issue. Unless the auditor reviewed the fixes, resolved means the project believes the finding is closed.
Figures as published by Coinspect, Tari and the bulletproofs-plus repository.
| Coinspect, Tari layer 1 | 50 issues: 22 high, 9 medium, 10 low, 9 informational, 0 critical |
|---|---|
| Coinspect engagement | 15 weeks, completed November 2023, base node and wallet |
| Coinspect scope | Around 60% of the most critical parts of roughly 250,000 lines |
| Coinspect remediation | All issues resolved and identified as such by Coinspect, per Tari |
| Quarkslab, Bulletproofs+ | 1 low, 2 informational; no particular security issues identified |
| Not covered by either | The Ootle layer 2 |
Why auditors keep a Critical tier at all. OWASP reserves Critical for findings that are both highly likely and high impact. Immunefi reserves it for direct loss of funds or total network shutdown. The tier exists to flag stop-everything conditions, which is exactly why its absence is a low bar rather than a high one.
What a genuinely reassuring summary looks like. Few or no highs, a scope that names the components and commit, remediation confirmed by the auditor, and a date close to the code you are actually running. Zero critical is table stakes, not the headline.
Tari's audit found no critical issues. Does that mean the code is safe?
No. High severity on the common scales already covers assets being stolen, lost or compromised, and on Immunefi's blockchain scale includes an unintended chain split. Tari's audit had zero criticals and 22 highs that could have enabled double spends or denial of service.
What is the difference between a critical and a high finding?
Critical on Immunefi means direct loss of funds or total network shutdown; OWASP reserves it for findings that are both highly likely and high impact. High covers serious but less absolute outcomes such as temporary freezing of funds or a chain split. The line is drawn by each firm's own scale.
What does it mean that Tari's audit covered 60% of the code?
It describes how much of the code was in scope, not how much passed. Around 60% of the most critical parts of roughly 250,000 lines were reviewed; the remainder was outside the engagement and untested by it.
How do I know whether Tari's 22 high-severity findings were actually fixed?
Look for the auditor confirming remediation, not only the project. Tari's update states the issues were resolved and identified as such by Coinspect. Also check whether the fixes themselves were reviewed, since a patch can introduce a new issue.
Can I trust a published audit report at face value?
Partly. Trail of Bits publishes reviews only for clients who permit it and says many more remain confidential, so the reports you can read are a chosen sample. Quarkslab's Tari report also notes it is bound to one commit and later changes may not have been examined.