Questions builders ask.
An AI audit reduces risk. It does not remove it. No report guarantees a contract is free of vulnerabilities, and 00trust says so plainly.
The short answers.
01Is a 00trust audit the same as a manual audit by a security firm?
No. It is an automated audit by AI agents and fixed checks. It is cheaper and faster, and it is honest about what it covers. Projects holding large amounts can use it before or alongside a manual audit.
02Can I audit my contract if my repository is private?
Yes. 00trust reads the files directly from GitHub with read-only access and never clones the repository. You can also upload your code instead, and the upload is deleted after the run. Source code is never published.
03Can I hide a bad report?
Yes, you can keep any report private. But a report can only be generated when there are no critical issues, and published reports show every finding and its status.
04What happens when I update my contract?
The new version has new hashes. You start a new audit. The old report stays on your project page, linked to the old hashes.
05What if someone changes the deployed contract after the audit?
If the deployed verifier keys no longer match the audited hashes, the public page shows the audit as outdated for that deployment.
06Why ADA?
Midnight is part of the Cardano ecosystem, and ADA is the token builders in that community already hold.
07Which AI models are used?
Models from providers such as Anthropic (Claude) and xAI (Grok). The exact model and version used is listed in every report.
08Does 00trust certify that a contract is safe?
No. 00trust never says a contract is certified, approved or safe. A report states what was audited, at which commit, compiled to which hashes, on which date, what was checked and what was found.
09How many runs does an audit include?
The single audit plan includes 3 runs. Each run audits one commit. A run that fails because of a 00trust error does not count against your runs, and extra runs can be bought for an audit that used all of its runs.
10Can rerunning an audit make a report look cleaner?
No. Deterministic checks run first, agents run with fixed settings per version, and reruns only review what changed. An unchanged code block keeps its findings, severity and wording, and a finding is only resolved when the code behind it changed and the fix is confirmed.
11How can I check a report without trusting 00trust?
Hash the JSON report and compare it with the on-chain registry, compare the audited verifier key hashes with the deployed contract on Midnight, and, for public repositories, rebuild the audited commit with the listed compiler version. A verification command line tool is planned.
12Which chains are supported?
Midnight first, with Compact contracts. Cardano (Plutus and Aiken) is next, then other chains.
Words that come up in every report.
- Compact
- The smart contract language used on Midnight.
- Circuit
- A function of a Compact contract, proven with zero-knowledge proofs.
- Verifier key
- The on-chain key used to check proofs for a circuit.
- Witness
- Private data a user provides to a circuit, not written to the ledger unless disclosed.
- Report hash
- The hash of the JSON report, anchored on-chain.
- Run
- One analysis of one commit.
- Finding
- One issue found by the audit.
- Acceptance score
- 100 minus the sum of the weights of open findings, with a minimum of 0. Higher is better.
- Critical-issue score
- The number of open critical findings. It must be zero to generate a report.