> For the complete documentation index, see [llms.txt](https://docs.originprotocol.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.originprotocol.com/security-and-risk/audits.md).

# Audits

This page maps published security work to the Origin products and components that use the reviewed code. It includes direct product reviews as well as relevant evidence from shared implementations.

Every report remains limited to its stated scope, version, date, and assumptions. Review the report itself and compare it with the current deployed code and configuration before relying on it.

### Shared code map

| Shared implementation                   | Products using it                                      | What is shared                                                                                                                                               |
| --------------------------------------- | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `OUSD.sol` rebasing-token core          | OUSD · OETH · superOETHb                               | OETH and Super OETH inherit the OUSD token implementation. Product contracts mainly specialize metadata and initialization.                                  |
| `VaultAdmin → VaultCore → VaultStorage` | OUSD · OETH · superOETHb                               | The products share the core vault accounting, minting, redemption, rebase, strategy-management, and withdrawal-queue architecture.                           |
| `WOETH` ERC-4626 wrapper                | wOUSD · wOETH · wsuperOETHb                            | The wrappers share conversion, deposit, and redemption accounting. Product wrappers primarily change names and symbols.                                      |
| Curve AMO lineage                       | OETH Curve AMO · OUSD Curve AMO · superOETHb Curve AMO | The OETH-audited implementation became the ancestor of later OUSD and Base variants. Their product-specific changes required a separate applicability check. |
| Algebra stable-swap AMO core            | Hydrex and related Algebra AMO implementations         | The audited SwapX implementation was later extracted into a reusable stable-swap strategy core. Protocol-specific adapters were added separately.            |
| `AbstractARM`                           | Lido ARM · Origin ARM · Ethena ARM · MultiAsset ARM    | ARM products share core swap, LP-share, fee, withdrawal-queue, accounting, and market-allocation logic.                                                      |

### OETH

| Component                            | Applicable reports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | Applicability                                                                                                                                             |
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| OETH token                           | <p>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Certora%20-%20Formal%20verification%20-%20December%202024.pdf">Certora — Formal Verification — Dec 2024</a> <br>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20OUSD%20-%20December%202024.pdf">OpenZeppelin — OUSD Yield Delegation — Dec 2024</a> <br>• <strong>Direct/shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Narya%20-%20Origin%20OETH%20Report%20-%20May%202023%20-%20Initial%20Report.pdf">Narya — OETH — May 2023</a> <br>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20-%20October%202021.pdf">OpenZeppelin — OUSD — Oct 2021</a> <br>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Trail%20of%20Bits%20-%20Origin%20Dollar%20-%20Dec%202020.pdf">Trail of Bits — OUSD — Dec 2020</a> <br>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Solidified%20-%20Origin%20Dollar%20-%20Dec%202020.pdf">Solidified — OUSD — Dec 2020</a></p>                                                                                                                                                                                   | OETH inherits the OUSD rebasing and accounting implementation. Narya directly exercised the OETH system.                                                  |
| OETH Vault                           | <p>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Sigma%20Prime%20-%20Origin%20OUSD%20Upgrade%20Security%20Assessment%20Report%20v2%20-%20February%202026.pdf">Sigma Prime — OUSD Upgrade — Feb 2026</a> • <strong>Direct/shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20WOETH%20and%20Vault%20Update%20-%20April%202025.pdf">OpenZeppelin — wOETH and Vault — Apr 2025</a> <br>• <strong>Direct/shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20OETH%20Withdrawal%20Queue%20Audit%20-%20August%202024.pdf">OpenZeppelin — Withdrawal Queue — Aug 2024</a> <br>• <strong>Direct/shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Perimeter%20-%20OETHVault%20-%20March%202024%20-%20Fuzzing%20Report.pdf">Perimeter — OETH Vault Fuzzing — Mar 2024</a> <br>• <strong>Direct/shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Narya%20-%20Origin%20OETH%20Report%20-%20May%202023%20-%20Initial%20Report.pdf">Narya — OETH — May 2023</a> <br>• <strong>Direct/shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20OETH%20Integration%20-%20May%202023.pdf">OpenZeppelin — OETH Integration — May 2023</a></p> | The OETH Vault uses the shared vault core. Reports cover different versions and features rather than one permanent deployment.                            |
| wOETH                                | <p>• <strong>Direct/shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20WOETH%20and%20Vault%20Update%20-%20April%202025.pdf">OpenZeppelin — wOETH and Vault — Apr 2025</a> <br>• <strong>Direct/shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Perimeter%20-%20WOETH%20Alternative%20Design%20-%20April%202025.pdf">Perimeter — wOETH Fuzzing — Apr 2025</a></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Direct reviews of the wrapper implementation now shared with other Origin wrappers.                                                                       |
| Curve AMO / Convex ETH Meta Strategy | • **Direct:** [OpenZeppelin — OETH Integration — May 2023](https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20OETH%20Integration%20-%20May%202023.pdf)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | The reviewed OETH strategy became the ancestor of the OETH, OUSD, and Base Curve AMO family.                                                              |
| Generalized ERC-4626 Strategy        | <p>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20OETH%20Integration%20-%20May%202023.pdf">OpenZeppelin — OETH Integration — May 2023</a> <br>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Narya%20-%20Origin%20OETH%20Report%20-%20May%202023%20-%20Initial%20Report.pdf">Narya — OETH — May 2023</a></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Explicitly reviewed for OETH.                                                                                                                             |
| Compounding Staking Strategy         | <p>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Nethermind%20-%20Origin%20Compounding%20Straking%20Strategy%20%20Audit%20-%20October%202025.pdf">Nethermind — Oct 2025</a> <br>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Compounding%20Staking%20Strategy%20Audit%20-%20September%202025.pdf">OpenZeppelin — Sep 2025</a> <br>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Sigma%20Prime%20-%20Origin%20Compounding%20Staking%20Strategy%20Audit%20-%20September%202025.pdf">Sigma Prime — Sep 2025</a></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Three independent reviews of the same strategy family.                                                                                                    |
| SSV Native Staking                   | <p>• <strong>Narrow follow-up:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Sigma%20Prime%20-%20Origin%20Protocol%20Validator%20Consolidations%20-%20February%202026.pdf">Sigma Prime — Validator Consolidations — Mar 2026</a> <br>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20SSV%20Native%20Staking%20-%20June%202024.pdf">OpenZeppelin — SSV Native Staking — Jun 2024</a></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | The 2024 report covered the strategy directly. The 2026 report covered consolidation and migration interactions, not the complete strategy.               |
| Vanilla Compounding Staking Strategy | <p>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Sigma%20Prime%20-%20Origin%20Protocol%20Vanilla%20Compounding%20Staking%20Strategy%20-%20June%202026.pdf">Sigma Prime — Jun 2026</a> <br>• <strong>Lineage:</strong> the three 2025 Compounding Staking reports above</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | The 2026 report reviewed the extracted implementation directly. Earlier reports cover its strategy lineage and shared beacon-proof and accounting design. |
| Mainnet governance                   | • **Shared:** [OpenZeppelin — OUSD Governance — Jun 2022](https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20Governance%20-%20June%202022.pdf)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | OETH reuses the Origin governance model and related trust assumptions.                                                                                    |

### OUSD

| Component                                        | Applicable reports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | Applicability                                                                                                                                    |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| OUSD token                                       | <p>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Certora%20-%20Formal%20verification%20-%20December%202024.pdf">Certora — Formal Verification — Dec 2024</a> <br>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20OUSD%20-%20December%202024.pdf">OpenZeppelin — Yield Delegation — Dec 2024</a> <br>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Narya%20-%20Origin%20OETH%20Report%20-%20May%202023%20-%20Initial%20Report.pdf">Narya — OETH — May 2023</a> <br>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20-%20October%202021.pdf">OpenZeppelin — OUSD — Oct 2021</a> <br>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Trail%20of%20Bits%20-%20Origin%20Dollar%20-%20Dec%202020.pdf">Trail of Bits — OUSD — Dec 2020</a> </p><p>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Solidified%20-%20Origin%20Dollar%20-%20Dec%202020.pdf">Solidified — OUSD — Dec 2020</a></p>                                                               | OUSD is the base token implementation. The OETH engagement also exercised this inherited code through OETH.                                      |
| OUSD Vault                                       | <p>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Sigma%20Prime%20-%20Origin%20OUSD%20Upgrade%20Security%20Assessment%20Report%20v2%20-%20February%202026.pdf">Sigma Prime — OUSD Upgrade — Feb 2026</a> </p><p>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20WOETH%20and%20Vault%20Update%20-%20April%202025.pdf">OpenZeppelin — wOETH and Vault — Apr 2025</a> </p><p>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20OETH%20Withdrawal%20Queue%20Audit%20-%20August%202024.pdf">OpenZeppelin — OETH Withdrawal Queue — Aug 2024</a> </p><p>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Perimeter%20-%20OETHVault%20-%20March%202024%20-%20Fuzzing%20Report.pdf">Perimeter — OETH Vault Fuzzing — Mar 2024</a> </p><p>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20Dripper%20%26%20Uniswap%20strategy%20-%20April%202023.pdf">OpenZeppelin — Dripper and Uniswap — Apr 2023</a> </p><p>• <strong>Direct:</strong> the 2021 and 2020 OUSD reports listed above</p> | OUSD and the OETH family use the same vault core. OETH-scoped queue, fuzzing, and vault reviews provide evidence for that shared implementation. |
| wOUSD                                            | <p>• <strong>Shared/current base:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20WOETH%20and%20Vault%20Update%20-%20April%202025.pdf">OpenZeppelin — wOETH — Apr 2025</a> </p><p>• <strong>Shared/current base:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Perimeter%20-%20WOETH%20Alternative%20Design%20-%20April%202025.pdf">Perimeter — wOETH Fuzzing — Apr 2025</a> </p><p>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Solidified%20-%20OGV%2C%20wOUSD%2C%20and%20ERC721a%20-%20May%202022.pdf">Solidified — OGV and wOUSD — May 2022</a></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | The 2022 report reviewed the former implementation. Current wOUSD inherits the later audited WOETH wrapper core.                                 |
| Governance                                       | • **Direct:** [OpenZeppelin — OUSD Governance — Jun 2022](https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20Governance%20-%20June%202022.pdf)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Direct review of the Origin Dollar governance contracts.                                                                                         |
| Curve AMO                                        | • **Lineage:** [OpenZeppelin — OETH Integration — May 2023](https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20OETH%20Integration%20-%20May%202023.pdf)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | The OUSD implementation was adapted from the audited OETH AMO lineage. Later OUSD-specific changes are not covered automatically.                |
| Cross-chain strategy v1 and vault simplification | • **Direct:** [Sigma Prime — OUSD Upgrade — Feb 2026](https://github.com/OriginProtocol/security/blob/master/audits/Sigma%20Prime%20-%20Origin%20OUSD%20Upgrade%20Security%20Assessment%20Report%20v2%20-%20February%202026.pdf)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Direct review of the shared-vault simplification and OUSD cross-chain and CCTP components in scope.                                              |
| Uniswap V3 Strategy                              | • **Direct:** [OpenZeppelin — Dripper and Uniswap — Apr 2023](https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20Dripper%20%26%20Uniswap%20strategy%20-%20April%202023.pdf)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | Direct review of the strategy and supporting vault changes.                                                                                      |
| Dripper / Harvester                              | <p>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Narya%20-%20Origin%20OETH%20Report%20-%20May%202023%20-%20Initial%20Report.pdf">Narya — OETH — May 2023</a> </p><p>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20Dripper%20%26%20Uniswap%20strategy%20-%20April%202023.pdf">OpenZeppelin — Dripper and Uniswap — Apr 2023</a> </p><p>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Solidified%20-%20OGV%2C%20wOUSD%2C%20and%20ERC721a%20-%20May%202022.pdf">Solidified — OGV and wOUSD — May 2022</a></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | Shared OUSD/OETH infrastructure.                                                                                                                 |

### superOETHb

| Component                                 | Applicable reports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Applicability                                                                                                               |
| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| superOETHb token                          | <p>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Certora%20-%20Formal%20verification%20-%20December%202024.pdf">Certora — Formal Verification — Dec 2024</a> </p><p>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20OUSD%20-%20December%202024.pdf">OpenZeppelin — OUSD Yield Delegation — Dec 2024</a> </p><p>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Narya%20-%20Origin%20OETH%20Report%20-%20May%202023%20-%20Initial%20Report.pdf">Narya — OETH — May 2023</a> </p><p>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20-%20October%202021.pdf">OpenZeppelin — OUSD — Oct 2021</a> </p><p>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Trail%20of%20Bits%20-%20Origin%20Dollar%20-%20Dec%202020.pdf">Trail of Bits — OUSD — Dec 2020</a> </p><p>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Solidified%20-%20Origin%20Dollar%20-%20Dec%202020.pdf">Solidified — OUSD — Dec 2020</a></p> | superOETHb inherits the OUSD token implementation. Base-specific administration and configuration remain separate.          |
| superOETHb Vault                          | <p>• <strong>Direct/shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Sigma%20Prime%20-%20Origin%20OUSD%20Upgrade%20Security%20Assessment%20Report%20v2%20-%20February%202026.pdf">Sigma Prime — OUSD Upgrade — Feb 2026</a> </p><p>• <strong>Shared:</strong> the wOETH/Vault, Withdrawal Queue, OETH Vault Fuzzing, Narya, and OETH Integration reports listed above</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | superOETHb uses the same vault core as OUSD and OETH.                                                                       |
| wsuperOETHb                               | <p>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20WOETH%20and%20Vault%20Update%20-%20April%202025.pdf">OpenZeppelin — wOETH — Apr 2025</a> </p><p>• <strong>Shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/Perimeter%20-%20WOETH%20Alternative%20Design%20-%20April%202025.pdf">Perimeter — wOETH Fuzzing — Apr 2025</a></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | wsuperOETHb inherits the audited WOETH wrapper implementation.                                                              |
| Aerodrome AMO                             | • **Direct:** [OpenZeppelin — Aerodrome AMO — Sep 2024](https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Aerodrome%20AMO%20Strategy%20Audit%20-%20September%202024.pdf)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Direct review of the Base strategy.                                                                                         |
| Base Curve AMO                            | • **Lineage:** [OpenZeppelin — OETH Integration — May 2023](https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20OETH%20Integration%20-%20May%202023.pdf)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Adapted from the audited OETH Curve AMO lineage. The Base integration came later.                                           |
| Hydrex AMO                                | • **Lineage:** [OpenZeppelin — SwapX AMO — Apr 2025](https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Sonic%20SwapX%20AMO%20Strategy%20Audit%20-%20April%202025.pdf)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Uses the stable-swap core extracted from the audited implementation. Hydrex-specific integration code was added separately. |
| Bridged wOETH and cross-chain strategy v1 | • **Direct/shared:** [Sigma Prime — OUSD Upgrade — Feb 2026](https://github.com/OriginProtocol/security/blob/master/audits/Sigma%20Prime%20-%20Origin%20OUSD%20Upgrade%20Security%20Assessment%20Report%20v2%20-%20February%202026.pdf)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | The report scoped BridgedWOETHStrategy and related shared cross-chain changes.                                              |

### ARM Vaults

| Component               | Applicable reports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Applicability                                                                                                                                                                |
| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Abstract ARM core       | <p>• <strong>Direct/shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/yAudit%20-%20Origin%20ARM%20upgrade%20-%20May%202026.pdf">yAudit — ARM Upgrade — May 2026</a> </p><p>• <strong>Direct/shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/yAudit%20-%20Origin%20ARM%20-%20December%202025.pdf">yAudit — ARM — Dec 2025</a> </p><p>• <strong>Direct/shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20ARM%20-%20June%202025.pdf">OpenZeppelin — Origin ARM — Jun 2025</a> </p><p>• <strong>Direct/shared:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Arm%20Audit%20-%20November%202024.pdf">OpenZeppelin — Lido ARM — Nov 2024</a></p> | All ARM products inherit the shared accounting, swap, LP-share, fee, withdrawal-queue, and market-allocation core.                                                           |
| Lido ARM                | <p>• <strong>Direct:</strong> yAudit May 2026 and yAudit Dec 2025 </p><p>• <strong>Shared:</strong> OpenZeppelin Jun 2025 </p><p>• <strong>Direct:</strong> OpenZeppelin Nov 2024</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Lido-specific withdrawal-queue behavior and the shared core were reviewed across these engagements.                                                                          |
| Origin ARM              | <p>• <strong>Direct:</strong> yAudit May 2026 </p><p>• <strong>Shared:</strong> yAudit Dec 2025 </p><p>• <strong>Direct:</strong> OpenZeppelin Jun 2025 </p><p>• <strong>Shared:</strong> OpenZeppelin Nov 2024</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | OriginARM is parameterized for its asset pair and inherits AbstractARM.                                                                                                      |
| Ethena ARM              | <p>• <strong>Direct:</strong> yAudit May 2026 </p><p>• <strong>Shared:</strong> yAudit Dec 2025 and both OpenZeppelin ARM reports</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | The Ethena-specific implementation was included in the May 2026 scope.                                                                                                       |
| MultiAsset ARM          | • **Lineage:** yAudit May 2026 • **Shared:** both OpenZeppelin ARM reports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Built from the audited ARM lineage but materially extended for multi-asset and mixed-decimal support. No direct published report was identified for the full implementation. |
| Asset adapters          | • **Direct:** [yAudit — ARM Upgrade — May 2026](https://github.com/OriginProtocol/security/blob/master/audits/yAudit%20-%20Origin%20ARM%20upgrade%20-%20May%202026.pdf)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | Origin, Lido, EtherFi, Ethena, and wrapped-asset adapters were scoped. Later adapters require separate review.                                                               |
| Lending-market wrappers | <p>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/yAudit%20-%20Origin%20ARM%20-%20December%202025.pdf">yAudit — ARM — Dec 2025</a> </p><p>• <strong>Direct:</strong> <a href="https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20ARM%20-%20June%202025.pdf">OpenZeppelin — Origin ARM — Jun 2025</a></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                       | The Morpho wrapper was included in yAudit; SiloMarket was included in OpenZeppelin.                                                                                          |
| CapManager              | • **Direct:** yAudit May 2026 and yAudit Dec 2025                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Directly reviewed in both engagements.                                                                                                                                       |

### OGN and xOGN

| Component                           | Applicable reports                                                                                                                                                                                       | Applicability                                           |
| ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- |
| OGV to OGN migration and xOGN       | • **Direct:** [OpenZeppelin — OGV/OGN Merge — May 2024](https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20OGV%20and%20OGN%20Merge%20-%20May%202024.pdf) | Direct migration and staking/governance review.         |
| OGV token and governance            | • **Direct:** [Solidified — OGV and wOUSD — May 2022](https://github.com/OriginProtocol/security/blob/master/audits/Solidified%20-%20OGV%2C%20wOUSD%2C%20and%20ERC721a%20-%20May%202022.pdf)             | Multi-scope report covering OGV and related components. |
| OGN staking and compensation claims | • **Direct:** [Solidified — OGN Staking — Dec 2020](https://github.com/OriginProtocol/security/blob/master/audits/Solidified%20-%20Origin%20Dollar%20-%20Dec%202020.pdf)                                 | Direct review of the contracts in scope at that time.   |

### Other security reports

#### Formal verification and fuzzing

These reports evaluate defined properties or explore a generated state and input space. They are not full-system audit certificates.

* [Certora — Formal Verification — December 2024](https://github.com/OriginProtocol/security/blob/1e0adf97ee4c148f1a0e19a3556849987776c703/audits/Certora%20-%20Formal%20verification%20-%20December%202024.pdf)
* [Perimeter — OETH Vault Fuzzing — March 2024](https://github.com/OriginProtocol/security/blob/master/audits/Perimeter%20-%20OETHVault%20-%20March%202024%20-%20Fuzzing%20Report.pdf)
* [Perimeter — wOETH Fuzzing — April 2025](https://github.com/OriginProtocol/security/blob/master/audits/Perimeter%20-%20WOETH%20Alternative%20Design%20-%20April%202025.pdf)

#### External risk assessments

These assessments examine collateral, liquidity, governance, or integration risk. They are not code audits.

* [LlamaRisk — Asset Risk Assessment: Origin Ether](https://llamarisk.substack.com/p/asset-risk-assessment-origin-ether)
* [Prisma Risk — Collateral Risk Assessment: wrapped OETH](https://hackmd.io/@PrismaRisk/wOETH#Collateral-Risk-Assessment---Wrapped-Origin-ETH-wOETH)
* [LlamaRisk — wrapped OETH assessment addendum](https://www.llamarisk.com/research/collateral-risk-woeth-addendum1)
* [Yearn Curation — Origin OUSD](https://curation.yearn.fi/report/origin-ousd/)
* [Yearn Curation — Origin ARM](https://curation.yearn.fi/report/origin-arm/)

### Dependency evidence

Origin products rely on external assets, protocols, validators, oracles, bridges, chains, and liquidity venues. Reports published by those dependencies can inform an assessment, but their assurance does not transfer to Origin's adapter, accounting, configuration, oracle use, or containment paths.

### Complete report archive

The [Origin security repository](https://github.com/OriginProtocol/security/tree/master/audits) contains the full archive of published reports. Repository presence alone does not establish current coverage: each report must be matched to the current code, deployment, configuration, dependencies, and remediation status.