# Audits

Kodiak has done 3 rounds of audits on the core protocols, as well as rounds of audits focused on different new products (Panda Factory, Bault, Meta-Aggregator, Fungible, etc).  In all audits - all issues raised have been addressed and no critical issues were found.<br>

**Core Protocol**

December 2024, 0xMacro: focused audit on Kodiak Islands and Farms

{% file src="<https://584145091-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOSwqNrRJ9Xh6jO57yoLm%2Fuploads%2Fs1TqcqIFZ5UkYF7iD5Nt%2Fkodiak_A3_by_0xmacro.pdf?alt=media&token=af493947-2a7e-409f-afb2-98b64c1f73ab>" %}

April 2024, 0xMacro: Dex Core and Periphery, Islands, Farms, Tokens

{% file src="<https://584145091-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOSwqNrRJ9Xh6jO57yoLm%2Fuploads%2FierRx3DPkFpZU4OY3fB5%2Fkodiak_A1_by_0xmacro.pdf?alt=media&token=0f6433d1-be3a-4b55-b1ac-9938535dec83>" %}

February 2024, Kalos: Dex Core and Periphery, Islands, Farms, Tokens

{% file src="<https://584145091-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOSwqNrRJ9Xh6jO57yoLm%2Fuploads%2FEGTuI70lM40vmr8YwZQT%2F%5BKALOS%5D%20KODIAK%20Audit%20Report%20(ENG).pdf?alt=media&token=1e8b2d8f-7473-481c-9961-77362e9d28c9>" %}

**Panda Factory**

October 2024, 0xMacro: Panda Factory

{% file src="<https://584145091-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOSwqNrRJ9Xh6jO57yoLm%2Fuploads%2FSz7GaLLOLF7H4FmxpGTR%2Fkodiak_A2_by_0xmacro.pdf?alt=media&token=d82d6748-eaf5-410f-9bed-e7cb16506fc8>" %}

**Bault**

May 2025, AstraSec: Bault (auto-compounding vaults)

{% file src="<https://584145091-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOSwqNrRJ9Xh6jO57yoLm%2Fuploads%2FEi2WQL3ewlsPDWDnlV9D%2FAstraSec-AuditReport-Kodiak-Bault.pdf?alt=media&token=35367cbd-2166-44ca-a974-a267892b33ed>" %}

**kX, Fungible**

May 2025, AstraSec: kX (aggregator), Fungible (NFT tokenization)

{% file src="<https://584145091-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOSwqNrRJ9Xh6jO57yoLm%2Fuploads%2FHLRHY2QFxlXLD1Yxcqku%2FAstraSec-AuditReport-Kodiak-DEX.pdf?alt=media&token=9d1624a4-6ffd-49f1-a3bd-7cffa57ac6dc>" %}

For technical reference, here is a brief technical overview of the various parts of the protocol:

* Dex V2: Exact fork of Uniswap V2
* Dex V3: Fork of Uniswap V3 with one small difference:&#x20;
  * Modified feeProtocol to uint32 in slot0 (only relevant for integrators, not normal users)
* Kodiak Island: "Modified from" Arrakis V1 vaults (ArrakisFinance/vault-v1-core). Key differences:&#x20;
  * Vaults are non-upgradeable after deployment (vs upgradeable in original implementation)
  * Simplified rebalances to enable "permissionless" fixed vault creation with no ownership
  * For managed vaults, rebalancing can route through liquidity throughout Berachain
* Kodiak Farm: "Modified from" Frax Communal Farm (FraxFinance/frax-solidity). Key differences:
  * Farms can be deployed permissionlessly via FarmFactory
* Panda Factory: Fully built in-house, very loosely "inspired by" pump.fun on Solana
* Bault: Fully built in-house, ERC-4626 compliant vaults that compound BGT with bounty mechanism
* Meta-Aggregator: Fully built in-house, Dex router that can call aggregator APIs
* Fungible: Fully built in-house, NFT tokenization product