Prepared: June 10, 2026
This note consolidates the technical/security wording, public audit links, upstream security references, and audit-coverage context for the XION/Verona chain.
XION / Verona is built on a security-first architecture that combines:
- third-party audits of XION/Burnt code,
- public upstream audit coverage across key Cosmos SDK and IBC components,
- CometBFT Byzantine Fault Tolerant consensus with deterministic finality,
- and ongoing security review and testing for new functionality.
Public audit materials are available for XION/Burnt through Oak Security, and the underlying Cosmos stack also benefits from additional public audit artifacts and formal security-maintenance programs. Taken together, this provides a strong security foundation for the chain, its account-abstraction model, and its core transaction infrastructure.
If the goal is to reassure an external requester while staying accurate, the safest concise wording is:
Verona (formerly XION) has undergone third-party security review and is built on audited core infrastructure. Public audit reports are available for XION/Burnt code through Oak Security, and the underlying Cosmos SDK / IBC stack also benefits from upstream public audit coverage and formal security maintenance. The chain uses CometBFT Byzantine Fault Tolerant consensus with deterministic finality and is supported by ongoing security review and testing for new functionality.
-
4.1 Token Contract Standard Cosmos SDK native token on the Verona (formerly XION) mainnet. IBC-compatible.
-
4.2 Token Contract Addresses N/A - Verona/XION is a native Cosmos SDK token (
uxiondenom), not a standalone ERC-20/CW20-style token contract, so there is no separate token contract address on mainnet. -
4.3 Mainnet Trading Model Account-based model (Cosmos SDK).
-
4.4 Mainnet Consensus Algorithm CometBFT (formerly Tendermint) - Byzantine Fault Tolerant consensus.
-
4.5 Average block-out speed of mainnet Approximately 4 seconds average block time.
-
4.6 Recommended billing frequency 1 block. CometBFT provides deterministic finality at block commit, so transactions can be securely accounted for after a single confirmed block.
-
5.1 Availability of third-party security audit for source code Yes - the XION/Verona blockchain and related account-abstraction infrastructure have undergone third-party security audits.
-
5.2 Availability of third-party security audit reports Yes - public third-party audit reports are available online.
-
5.3 Delivery method of third-party security audit report Public PDF audit reports are available through Oak Security's public GitHub audit repository under the "Burnt (XION)" section, supplemented by public upstream Cosmos SDK and IBC audit materials.
- Oak Security audit repository: https://github.com/oak-security/audit-reports/tree/main/Burnt%20%28XION%29
- XION and Burnt Contracts (September 22, 2023): https://raw.githubusercontent.com/oak-security/audit-reports/main/Burnt%20%28XION%29/2023-09-22%20Audit%20Report%20-%20XION%20and%20Burnt%20Contracts%20v1.1.pdf
- XION and Account Abstraction Updates 2 (May 25, 2024): https://raw.githubusercontent.com/oak-security/audit-reports/main/Burnt%20%28XION%29/2024-05-25%20Audit%20Report%20-%20XION%20and%20Account%20Abstraction%20Updates%202%20v1.0.pdf
- XION MiCAR white paper (states that underlying smart contracts underwent successful Oak Security audits and are publicly accessible online): https://xion.burnt.com/mica_whitepaper
- Cosmos security audits index: https://docs.cosmos.network/sdk/latest/security/audits
- Cosmos SDK 2019 final audit: https://github.com/cosmos/security/blob/main/audits/sdk/cosmos_sdk_2019_final.pdf
- Cosmos SDK v53 audit: https://github.com/cosmos/security/blob/main/audits/sdk/cosmos_sdk_v53_audit_final.pdf
- Cosmos SDK group module audit: https://github.com/cosmos/security/blob/main/audits/sdk/group_module_audit.pdf
ibc-gorepo audit index: https://github.com/cosmos/ibc-go- ICS20 fungible token transfer audit: https://github.com/informalsystems/audits/tree/dc8b503727adcbb8e29c3d3a25a9070e0bf1ec87/IBC-GO
- ICS20 v2 feature assessment: https://github.com/cosmos/ibc-go/blob/main/docs/audits/20-token-transfer/Atredis%20Partners%20-%20Interchain%20ICS20%20v2%20New%20Features%20Assessment%20-%20Report%20v1.0.pdf
- ICS27 interchain accounts - Trail of Bits: https://github.com/cosmos/ibc-go/blob/main/docs/audits/27-interchain-accounts/Trail%20of%20Bits%20audit%20-%20Final%20Report.pdf
- ICS27 interchain accounts architecture review: cosmos/ibc-go#631
- ICS08 wasm client review: https://github.com/cosmos/ibc-go/blob/main/docs/audits/08-wasm/Ethan%20Frey%20-%20Wasm%20Client%20Review.pdf
- ICS04 channel upgrade audit: https://github.com/cosmos/ibc-go/blob/main/docs/audits/04-channel-upgrades/Atredis%20Partners%20-%20Interchain%20Foundation%20IBC-Go%20Channel%20Upgrade%20Feature%20Assessment%20-%20Report%20v1.1.pdf
- Interchain Security audit: https://github.com/cosmos/security/blob/main/audits/ics/informal-ics-2023.pdf
- Cosmos security and maintenance policy (covers Cosmos SDK, CometBFT, and IBC): https://docs.cosmos.network/sdk/latest/security/security-policy
- Cosmos bug bounty program (covers Cosmos SDK, CometBFT, and IBC): https://docs.cosmos.network/sdk/latest/security/bug-bounty
- The technical denom/unit remains
uxion. - Current internal guidance is that exchanges should update ticker, display name, and logo, but should not be forced to change technical denom handling.
- Possible aliasing of the smallest unit was discussed internally but was still a confirm-with-engineering item and should not be presented as final unless separately confirmed.
- It is accurate to say that the chain and relevant infrastructure have been audited.
- It is accurate to say that public audit reports are available.
- It is accurate to say that the chain is built on a strong, audited security foundation with additional upstream coverage.