Security
Kann Audits reviewed the vault contracts (report, 1 November 2026) and found no Critical, High or Medium issues. The review covered the vault contracts only, and Gloam is still beta software.
Findings
Kann labels L-01 and L-02 Fixed because fixes are planned, and the rest Acknowledged. None of these changes are live yet. The vault cannot be upgraded, so changes land in the next vault.
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 3
- Informational
- 8
The review
- Reviewer
- Kann Audits
- Report date
- 1 November 2026
- Review period
- 26 to 30 October 2026
- Team
- 5 researchers
- Method
- Manual review plus Kann's AI model
- Commit
- aac9e18
- Size
- 668 nSLOC across 10 files
What it covered
These files at that commit, and nothing else.
Reviewed
- ShieldPoolCore
- ShieldPoolPayments
- ChangeTimelock
- IncrementalMerkleTreePoseidon
- NoteLibPoseidon
- DualProofVerifier
- 4 interfaces
Not reviewed
- Swap routers: GloamVaultSwap, V4, V4b, Tempo and SwapEscrow. These have only had internal review
- GloamPayMemo
- Generated verifiers
- Circuits
- The app and the relay
- The MCP server and the SDK
The 10 reviewed files have not changed on main since that commit. The deployed vault has identical bytecode on Robinhood Chain, Tempo, Base and Ethereum.
Check the contractsWhat it does not change
Still beta
Mainnet is beta software with deposit limits. A review lowers risk. It does not remove it.
The owner's power
The owner can swap the proof verifier after a public 3-day timelock (finding I-02). One wallet is the owner today, and a multisig is planned.
Report a bug
Tell us privately, and please don't post details until a fix ships.
- Emailhello@gloam.trade, with Security in the subject
- Direct message@gloamtrade on X
- PolicySECURITY.md
Test on a fork, a local chain or the testnet, never against the mainnet pools. Gloam does not run a paid bug bounty yet.