EVAA Protocol has published security reviews by Quantstamp and Trail of Bits for its TON lending contracts. That is meaningful evidence of external scrutiny, but it is not a blanket answer to “Is EVAA safe?” An audit examines a defined codebase; users also depend on the deployed version, price inputs, administrative controls and the liquidity available when they need to exit.
The practical question is which risks a particular review addressed, and which dependencies remain outside it. Buying an EVAA-branded token is also a different exposure from supplying collateral or borrowing through the lending protocol.
Start with the audit version, not the auditor's logo
EVAA's public contract repository identifies v6 as reviewed by Quantstamp and v8 as reviewed by Trail of Bits. It also provides revision references and instructions for comparing file hashes with the audit material. This makes the scope more useful than a generic “audited” badge.
Three comparisons matter: the reviewed code, the changes made after review, and the code deployed in the pool you use. A report on an earlier version does not automatically cover later upgrades, a fork or a different token contract. Pool configuration matters too: the same underlying code can behave differently with different collateral, limits or oracle settings.
| Evidence | What it helps establish | What it does not establish |
|---|---|---|
| Named audit and code revision | Which implementation received external review | Every later deployment is covered |
| Finding and fix status | How a documented issue was handled | No undiscovered vulnerabilities remain |
| Signed oracle package | Data origin and integrity under verification rules | The price is always economically correct |
| Multisignature administration | Multiple approvals can be required for privileged actions | All administrative or upgrade risk disappears |
Reading scope is especially important when an app adds assets or integrations. A lending-contract review should not be extended to a bridge, wallet interface or third-party pool merely because the components appear in the same user journey.
Read findings together with the response
The Trail of Bits report published in August 2025 records nine findings: seven resolved and two unresolved after its fix review. The two unresolved items were classified as informational, concerning origination-fee application after a collateralization check and the effect of liquidation-threshold changes on existing positions. The report includes the team's context for those decisions.
These historical statuses neither prove a current exploit nor support a claim that every finding was fixed. They illustrate why the response matters: a concern may be addressed through a code change, a configuration constraint or an operating commitment, and those measures provide different kinds of protection.
For a reader, the useful follow-up is whether a mitigation is enforced by the contract or depends on people maintaining a policy. A promise to notify borrowers before a parameter change is operationally relevant, but it is different from a technical restriction that prevents that change.
Oracles connect price information to borrowing decisions
EVAA's oracle documentation describes signed price packages, multiple configured oracle instances and median aggregation. It lists sources including Pyth, RedStone and Stork, alongside derived values for some assets. The contracts check package validity, signatures, timestamps and the required source count.
These checks address different failure modes. A signature authenticates the report under the accepted key; a timestamp limits its accepted age; a source-count requirement prevents one report from satisfying a multi-source rule. None alone proves that the underlying market remained liquid or that independent-looking inputs had no shared weakness.
Consider a purely illustrative loan: collateral worth $1,000 supports $600 of debt. If collateral falls to $700 while debt stays unchanged, debt rises from 60% to roughly 85.7% of collateral value. Whether liquidation becomes possible depends on that pool's actual parameters. A stale high price could hide the deterioration, while a falsely low price could make a healthy position appear weaker.
Rejecting invalid data can protect accounting while temporarily preventing a price-sensitive operation. A user may therefore face an availability problem even when the checks work as intended. Our blockchain oracle guide explains why delivery, freshness and interpretation need separate assessment.
Correct code can still leave a user unable to exit
Smart-contract safety and economic safety overlap, but they are not identical. EVAA's risk and withdrawal documentation explains that supplied funds can be withdrawn only to the extent that pool liquidity is available. Assets borrowed by other users are not immediately available for withdrawal simply because a supplier's account shows a positive balance.
Borrowers face a different exposure: falling collateral value, rising debt value or accrued interest can reduce their buffer. Liquidators must also be able to execute and dispose of collateral during stress. A correctly calculated position does not guarantee that every needed transaction will complete before the market moves further.
Administrative controls add another layer. EVAA states that administrative functions use multisignature control. Users should still understand which actions those keys can authorize, including upgrades or parameter changes. Multisignature approval can reduce reliance on one key without removing privileged power.
For the broader lending mechanics, see our EVAA liquidation and lending risk analysis. The relevant buffer is specific to the position and pool, rather than a universal “safe” borrowing percentage.
Keep token-market risk separate from protocol security
An EVAA-branded token on another network is not automatically covered by audits of TON lending contracts. Confirm its issuer or documented bridge relationship before treating it as the protocol token. Token ownership, supplying a lending pool and holding a borrowed asset are separate positions with different rights and risks.
The EVAA-labelled Solana market on KTX ON-Chain provides a market-data entry for that specific mint. Its displayed name and quote do not establish an audit relationship with the TON protocol. Review executable liquidity and the full token identity; a nearly flat chart does not establish stable value or easy resale.
FAQ
Does an audit mean funds are insured?
No. A technical review is not an insurance policy or a repayment guarantee. Any separate protection arrangement would need its own terms, exclusions and claims process.
Can suppliers be liquidated without borrowing?
A supply-only position does not create a borrowing shortfall by itself. Suppliers still face contract, asset and withdrawal-liquidity risks. Adding borrowing changes the position's risk profile.
Does a successful small withdrawal prove the whole balance is safe?
No. It tests one transaction at one moment. Larger withdrawals may face different liquidity constraints, and a later upgrade or market shock can change conditions.
Does a high APY compensate for all these risks?
No. Quoted yield can change and does not price every loss scenario. Compare the source of interest, incentives, withdrawal conditions and potential principal loss.
Can a wallet connection alone assess EVAA's safety?
No. A wallet connection is not a security review. Read each requested signature and transaction, use the intended network and never disclose a recovery phrase or private key to a support account.
DeFi protocols and token markets can produce substantial losses. Audits reduce some uncertainty but do not guarantee security, liquidity or returns. This article is educational, not an investment recommendation.