Security & Audit Status
TAG IT Network is pre-mainnet. This page documents the current, verified security status of our smart contracts — what has been reviewed, what is planned, and how to report vulnerabilities.
Security Status Overview
The table below reflects the actual state of security work on TAG IT Network smart contracts:
| Date | Review | Scope | Result | Status |
|---|---|---|---|---|
| Jan 2026 | Internal security review + Slither static analysis | Core contracts | 0 high / 0 critical findings | Completed |
| Targeted Q3–Q4 2026 | External audit — Hacken | Full protocol (pre-mainnet) | Report will be published here | Planned / In Progress |
TAG IT Network smart contracts have not yet completed a third-party security audit. An external audit engagement with Hacken is planned ahead of mainnet launch. Until it is complete, treat the contracts as unaudited pre-production software.
Internal Security Review - January 2026
In January 2026 the TAG IT engineering team completed an internal security review of the core contracts, combining manual review with automated static analysis.
Review Scope
- TAGITCore.sol - ERC-721 digital twins and asset lifecycle state machine
- TAGITAccess.sol - BIDGES badge and capability system
- TAGITRecovery.sol - Lost/stolen asset recovery protocol
- TAGITGovernor.sol - Governance voting and proposal execution
- TAGITTreasury.sol - Fee collection and distribution
Results
- Slither static analysis: 0 high-severity and 0 critical-severity findings
- Manual review: Checks-effects-interactions pattern, ReentrancyGuard on state-changing functions, custom errors, and input validation verified across the reviewed contracts
- Testing: Unit and fuzz test suites run in CI on every pull request
An internal review and static analysis pass reduce risk but do not replace an independent third-party audit. External audit results will be published on this page once available.
External Audit - Planned
An external audit engagement with Hacken is planned and in preparation, targeted for Q3–Q4 2026, ahead of mainnet launch.
- Auditor: Hacken
- Timing: Targeted Q3–Q4 2026, before any mainnet deployment
- Scope: Full protocol - core lifecycle, access control, recovery, governance, and treasury contracts
- Publication: The full report and remediation status will be published on this page
Always verify you are interacting with our official contract addresses listed in the Contract Addresses documentation. Phishing contracts may attempt to impersonate TAG IT Network.
Bug Bounty Program
TAG IT Network does not currently run a public bug bounty program. A public program will launch together with mainnet, after the external audit is complete.
Until then, we welcome security reports through the responsible disclosure process below.
Responsible Disclosure
We take security seriously and encourage responsible disclosure of any vulnerabilities.
How to Report
- Document the vulnerability with clear reproduction steps
- Include proof-of-concept code if applicable
- Submit your report to security@tagit.network
- Allow our team time to acknowledge, verify, and remediate the issue
Responsible Disclosure Policy
- Do provide detailed reports with reproduction steps
- Do give us reasonable time to respond (minimum 90 days)
- Do make a good faith effort to avoid privacy violations and data destruction
- Don't publicly disclose vulnerabilities before they are fixed
- Don't access or modify other users' data
- Don't perform actions that could harm our users or services
Contact Information
- Email: security@tagit.network
- Response Time: We aim to acknowledge reports within 48 hours
Security researchers acting in good faith and following our responsible disclosure policy are protected under our Safe Harbor agreement. We will not pursue legal action against researchers who comply with our guidelines.
Audit Reports
There are no published audit reports yet. The Hacken audit report will be made available for download on this page once the engagement is complete.
Edit this page on GitHub