A detailed breakdown of what I actually verified — the audit, the bug bounty, the scope, and the numbers behind all of it. I used to check one thing before trusting a protocol: was there an a
A detailed breakdown of what I actually verified — the audit, the bug bounty, the scope, and the numbers behind all of it.
I used to check one thing before trusting a protocol: was there an audit, yes or no. It took getting burned once to realize that's the wrong question. An audit is a snapshot — a record of what a codebase looked like on one specific day. What actually matters to me now is whether security is something a team keeps doing, not something they did once and then put in a pitch deck.
"An audit tells you the code was fine once. It doesn't tell you it's still fine six months and forty new features later."
STON.fi is the clearest example I've found on TON of a protocol treating security as an ongoing discipline instead of a launch-day checkbox. I didn't want to just repeat their claims, so I went and checked the actual audit report, the actual bug bounty scope, and the actual reward structure myself. Here's everything I found.
The Trail of Bits audit.STON.fi's v2 contracts went through an 8-week security review by Trail of Bits, published in January 2025 and available as a public PDF report. Trail of Bits isn't a name I take lightly — this is a firm that has audited infrastructure used by billions of people, not a small boutique shop handing out rubber-stamp approvals. The full report, including the fix-review chapter, is public. I didn't just read a summary — I checked that the report actually exists and covers what STON.fi claims it covers: swap flows, liquidity pool math, and vault logic.
The Omniston escrow audit.Separately, Omniston's escrow contracts — the newer piece of infrastructure handling cross-chain and RFQ-based swaps — went through their own audit, conducted by the TonTech team, with no critical issues found. I care about this one specifically because it shows the security process didn't stop after v2 shipped. New infrastructure got its own independent review before going live.
Continuous monitoring via CertiK Skynet.On top of the point-in-time audits, STON.fi runs continuous monitoring through CertiK's Skynet platform. This is the part most protocols skip — a live monitoring layer instead of a one-time report sitting in a GitHub repo collecting dust.
The HackenProof bug bounty — and this is where it got specific.I expected a vague "we have a bug bounty" claim. What I actually found was a fully scoped program with five in-scope smart contracts, all rated Critical severity:
The reward structure is tiered by actual impact, not a flat number:
"A $100,000 top reward isn't a marketing number when it's tied to a specific, narrow definition of 'direct theft of user funds.' That specificity is what convinced me this isn't just a badge — it's an actual incentive structure."
What I also noticed, and appreciated, is what's explicitly excluded from rewards: things like slippage-related frontrunning, gas optimization suggestions, and centralization critiques. That might sound like a protocol dodging responsibility, but I read it the opposite way — a program that pays for anything and everything usually means the scope was never taken seriously in the first place. A tight, specific scope focused on fund-loss scenarios tells me the team thought carefully about what actually matters.
At the time I checked, the program had around 118 registered researchers and over 200 submitted reports. That's not a bounty program nobody knows about — it's one people are actively poking at.
Here's the pattern I look for now in any protocol, STON.fi included: does security stop the day the product launches, or does it keep evolving alongside the product?
Protocols don't stay static. New pools launch. New integrations get added. Omniston's cross-chain expansion alone introduces mechanisms — HTLC-based atomic swaps, escrow contracts, resolver networks — that didn't exist in the original v2 audit scope. Every one of those is a new surface for something to break, and a single audit from a year ago says nothing about code that didn't exist yet.
"The teams I trust aren't the ones who got audited. They're the ones who keep getting audited, keep expanding their bounty scope, and keep publishing what they find — good or bad."
What actually separates STON.fi from a lot of "audited" protocols I've looked at is that each new piece of infrastructure — Omniston's escrow contracts, for example — got its own dedicated review instead of being quietly bolted onto the original audit's reputation. That's the operational habit I care about far more than any single PDF report.
None of this makes STON.fi risk-free — nothing in DeFi is, and I'd be lying if I said otherwise. Audits reduce risk; they don't eliminate it. What this setup does give me is something more useful than a false sense of certainty: the ability to actually verify the claims myself instead of trusting a badge on a landing page.
I can read the Trail of Bits report line by line. I can look at exactly which contracts are in scope for the bug bounty and which specific failure modes are being paid for. I can see that new infrastructure gets audited separately rather than inheriting trust from an old report. That combination — transparency plus a track record of continuing the process — is what actually makes me comfortable putting real capital into pools like STON/USD₮ and USD₮/JETTON, rather than just believing a headline that says "audited."
"I don't trust protocols because they say they're secure. I trust the ones that show me exactly where I can go check for myself."
What do you personally check first before trusting a DeFi protocol with real money — the audit, the bounty scope, or something else entirely?
Explore the pools yourself 👉 app.ston.fi/poolsFull security details 👉 docs.ston.fi/getting-started/security
I don't expect anyone to just take my word for any of this, so here's everywhere I pulled these facts from — go verify them yourself:
Not financial advice — DYOR.
