Keystone shared initial results from Least Authority's review of its Zcash integration in February 2025. Least Authority completed the final report on March 20 and published it on March 26, documenting the review scope, findings, and Keystone's remediation responses.
The final report did not identify a critical-severity vulnerability in the reviewed implementation. It also discusses the cryptographic components, randomness handling, and treatment of sensitive data within the audited scope.
Like any security audit, this is a point-in-time assessment of specified code and assumptions—not a guarantee that the product is free of all vulnerabilities. Users should keep firmware and wallet software current and verify transaction details on the Keystone screen.