> For the complete documentation index, see [llms.txt](https://docs.zestprotocol.com/start/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zestprotocol.com/start/stacks-swap-smart-contracts/audits.md).

# Audits

### Security-First Design

Zest Protocol Stacks Swap is built by the Zest Protocol team, whose lending contracts are among the most thoroughly reviewed on Stacks. The swap contracts follow the same fail-closed philosophy:

* **Non-custodial architecture**: router and adapter contracts hold no user funds between swaps, so there is no pooled user balance to attack
* **Measured outputs**: the amount delivered to the user is measured on-chain from actual pool transfers, never estimated
* **On-chain minimum-received and deadline checks**: any violated protection reverts the entire transaction
* **Stateless adapters**: every adapter is verified to hold no residual balance after a swap
* **Adversarial test suite**: the contracts are tested against malicious-adapter and reentrancy scenarios in addition to standard functional coverage

#### Audit Reports

**Zest Protocol Stacks Swap has been audited by:**

* [**Clarity Alliance**](https://x.com/ClarAllianceSec) - Leading Clarity security firm

#### Audit Reports

* [**Clarity Alliance - Zest Protocol's DEX Aggregator Security Review**](https://clarity-alliance.github.io/audits/Clarity%20Alliance%20-%20Zest%20Protocol%20DEX%20Aggregator.pdf) - July 17th, 2026

### **Continuous AI Security Testing**

Audits are a snapshot. Security is a process. Zest Protocol runs a continuous, automated security harness against its contracts around the clock, driven by every frontier AI model from the day it ships.

Each new model release is deployed against the codebase as a fresh adversary, probing for anything that could put user funds or protocol state at risk. Every candidate finding is verified against the live contract code before it counts as a result.

Every released frontier model has been run against the protocol. The record: zero valid bug reports since the start of 2026.

Frontier models keep getting better at finding vulnerabilities. That is exactly why each new one is pointed at Zest Protocol's code first. The strongest attacker on the market is always working for the protocol, not against it.