> For the complete documentation index, see [llms.txt](https://docs.tajirchain.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tajirchain.com/security-and-audits/smart-contract-audit-quillaudits.md).

# Smart Contract Audit – QuillAudits

## Tajir Token & Vesting Smart Contract Audit – QuillAudits

Tajir Chain’s token and vesting smart contracts were independently reviewed by QuillAudits.

The audit assessed the quality, security and correctness of the token, token proxy and vesting-wallet contracts included in the documented audit scope.

> This audit covers the specific contracts and source-code versions identified below. It is not an audit of every Tajir Chain network component.

### Public Audit Report

The complete audit report is publicly available in the auditor’s GitHub repository.

[View the complete Tajir Chain Smart Contract Audit Report](https://github.com/Quillhash/QuillAudit_smart_contract_audit_Reports/blob/master/Tajir%20chain%20Smart%20Contract%20Audit%20Report%20-%20QuillAudits.pdf)

### Audit Overview

<table data-search="false"><thead><tr><th>Property</th><th>Details</th></tr></thead><tbody><tr><td>Project</td><td>Tajir Chain</td></tr><tr><td>Auditor</td><td>QuillAudits</td></tr><tr><td>Report date</td><td>July 2026</td></tr><tr><td>Protocol type</td><td>ERC-20 token and vesting</td></tr><tr><td>Language</td><td>Solidity</td></tr><tr><td>Blockchain environment</td><td>Tajir Chain, EVM</td></tr><tr><td>Initial review</td><td>July 21, 2026</td></tr><tr><td>Updated code received</td><td>July 24, 2026</td></tr><tr><td>Second review</td><td>July 27, 2026</td></tr><tr><td>Additional change review</td><td>August 27, 2026</td></tr><tr><td>Total findings</td><td>13</td></tr><tr><td>Critical findings</td><td>0</td></tr><tr><td>Open findings</td><td>0</td></tr><tr><td>Resolved findings</td><td>5</td></tr><tr><td>Acknowledged findings</td><td>8</td></tr></tbody></table>

### Audit Scope

The report lists the following contracts as in scope:

| Contract                 | Purpose                                                                      |
| ------------------------ | ---------------------------------------------------------------------------- |
| `TajirToken.sol`         | Fixed-supply, upgradeable ERC-20 token with EIP-2612 permit support          |
| `TajirTokenProxy.sol`    | ERC-1967 proxy deployed in front of the token implementation                 |
| `TajirVestingWallet.sol` | Tranche-based token vesting, cliff and administrative clawback functionality |

The review covered the Tajir token and vesting layer. According to the report, the token contract is designed as a fixed-supply, UUPS-upgradeable ERC-20 contract. The vesting contract extends an upgradeable vesting-wallet structure with cliff and tranche-based release functionality.

### Source-Code References

| Reference                        | Value                                      |
| -------------------------------- | ------------------------------------------ |
| Audited branch                   | `foundry`                                  |
| Audited commit                   | `01802d8370699dbe09ec1113df59c6388c32eb51` |
| Remediation commit               | `f70f18049eeb85102bbacf947942912cacec107f` |
| Additional burn-mechanism review | `c6c860315e7de8b9e0adb6cb13def170b4630bfd` |

These commit references are taken directly from the public audit report.

Integration partners should verify that the deployed implementation bytecode corresponds to the appropriate audited or reviewed source-code version.

### Findings Summary

The audit identified 13 findings across four severity categories. No critical-severity finding was reported.

| Severity      |  Total | Resolved | Acknowledged |  Open |
| ------------- | -----: | -------: | -----------: | ----: |
| Critical      |      0 |        0 |            0 |     0 |
| High          |      2 |        1 |            1 |     0 |
| Medium        |      5 |        1 |            4 |     0 |
| Low           |      2 |        0 |            2 |     0 |
| Informational |      4 |        3 |            1 |     0 |
| **Total**     | **13** |    **5** |        **8** | **0** |

### Understanding the Finding Statuses

#### Resolved

The development team made a code change intended to address the reported finding, and the remediation was reviewed as part of the audit process.

#### Acknowledged

The finding was reviewed and formally acknowledged, but the underlying behavior was retained based on the system’s intended design, operating assumptions or accepted risk.

Acknowledged does not mean resolved. Developers, exchanges and integration partners should read the related finding and team response in the complete report.

#### Open

An open finding has not been resolved or formally accepted. The final report records zero findings with an open status.

### Detailed Findings

#### High Severity

| No. | Finding                                                                             | Status       |
| --- | ----------------------------------------------------------------------------------- | ------------ |
| 1   | Unprotected inherited initializer allows seizure of an uninitialized vesting wallet | Resolved     |
| 2   | A single global revoked flag voids the vesting schedule for every asset held        | Acknowledged |

#### Medium Severity

| No. | Finding                                                                                | Status       |
| --- | -------------------------------------------------------------------------------------- | ------------ |
| 3   | `renounceOwnership()` and `transferOwnership()` are inherited without being overridden | Acknowledged |
| 4   | Unguarded subtraction underflows against balance-reducing tokens                       | Resolved     |
| 5   | `initialize()` does not validate `startTimestamp`                                      | Acknowledged |
| 6   | Clawback commits an irreversible flag without a balance-delta assertion                | Acknowledged |
| 7   | Schedule parameters are read live without a clamp                                      | Acknowledged |

#### Low Severity

| No. | Finding                                                                   | Status       |
| --- | ------------------------------------------------------------------------- | ------------ |
| 8   | Tranche quantization allows revocation to remove a nearly elapsed tranche | Acknowledged |
| 9   | `TajirToken.initialize` silently rescales `initialSupply`                 | Acknowledged |

#### Informational

| No. | Finding                                                                         | Status       |
| --- | ------------------------------------------------------------------------------- | ------------ |
| 10  | `revoked` has no getter and its guard precedes the authorization gate           | Resolved     |
| 11  | `withdrawUnreleased` re-derives `releasable()` inline                           | Resolved     |
| 12  | Floor division routes rounding remainders away from the beneficiary             | Resolved     |
| 13  | `upgradeToAndCall` is inherited as payable without a native-token handling path | Acknowledged |

The titles above summarize the report’s findings. Refer to the complete audit report for the technical description, impact analysis, likelihood assessment, proof of concept, recommendations and Tajir team responses.

### Review and Remediation Timeline

#### Initial Review

QuillAudits performed the initial review on July 21, 2026.

The audited source-code version was identified by commit:

```
01802d8370699dbe09ec1113df59c6388c32eb51
```

#### Updated Code

The Tajir team provided updated code on July 24, 2026.

#### Second Review

QuillAudits performed a second review on July 27, 2026.

The report identifies the following remediation commit:

```
f70f18049eeb85102bbacf947942912cacec107f
```

#### Additional Token-Contract Review

On August 27, 2026, the Tajir team submitted additional token-contract changes related to small burn mechanisms for review.

The reviewed change was identified by commit:

```
c6c860315e7de8b9e0adb6cb13def170b4630bfd
```

The report states that QuillAudits reviewed these changes and did not identify new vulnerabilities in the reviewed modifications.

This additional review applies to the changes represented by that commit and should not be interpreted as a new audit of components outside the original scope.

### Audit Methodology

The audit used a combination of:

* Structural analysis
* Static analysis
* Manual code review
* Functional testing
* Automated testing
* Fuzz testing
* Gas-consumption review
* Threat modelling

The review considered:

* Code quality
* Smart-contract design and structure
* Access control
* Initialization safety
* Upgradeability
* Vesting calculations
* Token calculations
* ERC standard implementation
* Reentrancy and common vulnerability patterns
* Gas usage
* Documentation and intended behavior
* Token release and clawback behavior
* Handling of standard and non-standard tokens

### Tools Referenced in the Report

The report identifies the following tools and development environments:

* Foundry
* Remix IDE
* Solhint
* Mythril
* Slither
* Solidity static-analysis tooling

Automated results were manually reviewed to distinguish valid findings from false positives.

### Functional Testing

The functional testing covered the following areas.

#### Initialization

* Valid initialization parameters
* Zero-address validation
* Tranche-duration validation
* Total-tranche validation
* Cliff and duration calculations
* Repeated initialization
* Inherited initializer behavior
* Start-timestamp behavior
* Separation of administrative roles
* Implementation-contract initialization protection

#### Vesting Schedule

* Pre-cliff release behavior
* Cliff boundaries
* Tranche calculations
* Full vesting at the end of the schedule
* Single-tranche schedules
* Small-balance handling
* Release calculations between tranche boundaries

#### Token Release

* ERC-20 release
* Native-asset release
* Beneficiary payment behavior
* Repeated releases
* Released-amount accounting
* Conserving-token behavior

#### Clawback and Revocation

* Administrative authorization
* Unvested-surplus withdrawal
* Destination-address validation
* Repeated revocation
* Preservation of vested but unreleased balances
* Revocation events
* Native-asset revocation
* Multi-asset behavior
* Transfer balance-delta behavior

#### Access Control and Upgradeability

* Upgrade authorization
* Unauthorized upgrade rejection
* Storage preservation
* Upgrade effects on released balances
* TajirToken upgrade roles
* Administrative-role protection

#### TajirToken

* Initial token supply
* Holder and upgrader validation
* Supply validation
* Mint and burn surfaces
* EIP-2612 permit signatures
* Signature replay protection
* Permit deadlines
* Chain-specific domain separation

#### Non-Standard Token Handling

* Rebasing tokens
* Fee-on-transfer tokens
* Tokens without Boolean transfer return values
* Tokens that revert on zero-value transfers

### Fuzzing and Invariant Testing

The report documents successful invariants related to:

* Release functions not reverting for conserving assets
* Released amounts not exceeding vested amounts
* Contract solvency
* No value being releasable before the cliff
* Vested amounts remaining within the allocation
* Token conservation
* Beneficiary receipts matching released accounting

The report also records failed invariant tests associated with the findings documented above. These include initializer behavior, ownership assumptions, multi-asset revocation behavior, clawback balance assertions and behavior involving non-conserving assets.

These results should be evaluated together with the corresponding findings, remediation status and Tajir team response in the full report.

### Components Outside This Audit Scope

The report lists only the three token and vesting contracts identified above as in scope.

It should not be presented as an audit of:

* Tajir Chain node software
* Rollup or sequencing infrastructure
* Consensus or finality mechanisms
* RPC infrastructure
* Block Explorer
* Indexer
* Bridge UI
* Bridge contracts not explicitly listed in the report
* Wallet applications
* Exchange integrations
* Frontend applications
* Backend services
* Governance procedures
* Multisignature operational processes
* Cloud infrastructure
* Key-management procedures

Separate assessments should be used for components outside the documented smart-contract scope.

### Verification Guidance for Exchanges and Integrators

Before relying on the audit, exchanges and integration partners should independently verify:

1. The deployed proxy address.
2. The current implementation address.
3. The implementation bytecode.
4. The relationship between the proxy and implementation.
5. The current administrator and upgrader permissions.
6. Whether the deployed implementation matches the audited or reviewed commit.
7. Whether any upgrades occurred after the final review.
8. Whether acknowledged findings affect the proposed integration.
9. Whether contracts outside the audit scope are involved.
10. Whether token supply, decimals and network information match official on-chain records.

### Security Is an Ongoing Process

A smart-contract audit reduces risk but does not guarantee that a contract or system is free from vulnerabilities.

Security can also depend on:

* Deployment configuration
* Upgrade controls
* Administrative permissions
* Multisignature security
* Key custody
* External dependencies
* Bridge security
* Infrastructure monitoring
* Operational procedures
* Changes made after the audit

Tajir Chain users and integration partners should review the complete report and perform their own technical and risk assessment.

### Report Authenticity

The public report is hosted in QuillAudits’ audit-report repository:

[Open the official public audit report](https://github.com/Quillhash/QuillAudit_smart_contract_audit_Reports/blob/master/Tajir%20chain%20Smart%20Contract%20Audit%20Report%20-%20QuillAudits.pdf)

The report also directs readers to the QuillAudits leaderboard for authenticity verification:

[QuillAudits Leaderboard](https://www.quillaudits.com/leaderboard)

### Disclaimer

This page summarizes information contained in the public QuillAudits report. If any summary on this page differs from the original report, the original audit report should be treated as the authoritative source.

The audit is not a security guarantee, investment advice or endorsement. It reflects the reviewed source code and documented scope at the time of assessment.