blastSecurity audits
Asymptotic — Blast Launchpad, October 2026
Section titled “Asymptotic — Blast Launchpad, October 2026”Download the full audit report (PDF, 30 pages). The same unmodified report and its scope are available in the canonical Move contract repository.
Reviewed source
Section titled “Reviewed source”The report reviews the commit-launchpad branch of
interest-protocol/blast-v2-contracts:
- Review start:
b549bb16e02e4c6e8ff59e1958435a638c784973. - Final reviewed commit, including remediation:
01d7659617abcd552cece6d05b9db409ec4ff2c0.
The audit covers only the launchpad, blast_fun in sui/launchpad: the launch lifecycle and bonding curve, fee custody and claims, creator authority, configuration, package administration, and migration handoff.
Presale, Blast SUI, Boosts, migrators, and the generated-coin template are outside scope. Migration adapters, receiving DEX venues, and off-chain services are also outside scope. Read the report’s Scope and Coverage and Limitations sections for the full boundaries.
Findings and remediation
Section titled “Findings and remediation”| Severity | Confirmed findings |
|---|---|
| Critical | 0 |
| High | 0 |
| Medium | 0 |
| Low | 5 |
| Informational | 5 |
The auditor marks eight findings remediated: L-1, L-2, L-5, and I-1 through I-5. L-3 and L-4 remain acknowledged in the report; they concern upgrade administrator and root administrator custody. These are the report’s statuses at the final reviewed commit.
The multisig configuration and deployment references provide separate operational evidence. Audit coverage applies to the reviewed revisions; a later source revision or deployment needs its own comparison with the audited code.
Report integrity
Section titled “Report integrity”SHA-256 of the downloadable PDF:
09d627f8c5e58374ed28f1e1237a8472e3749b19c259fc3da82635e731e7801b