Let's talk about what
@tokenforge 's audit actually covers. Because "audited" gets thrown around a lot, and most people never check what that word is actually hiding.
SolidProof did a review. But it only covered one contract: "Paymaster.sol".
ยซThat's the piece that handles payments, and it lets the owner add or remove tokens and change the target wallet.ยป
The report came back clean, just some informational notes, nothing serious.
Here's the catch.
Everything else, the actual token issuance logic, the utility contracts, the rest of TokenSuite, wasn't in scope. And the audit didn't include functional testing either.
So "audited" here means one specific piece got checked, not the whole system.
The report also flags something worth knowing:
ยซThe owner keeps control, and the contract is upgradeable.ยป
That's normal for a platform built for institutions. They need the ability to fix things or adjust.
But it does mean this isn't the "code is law, nobody can touch it" kind of setup. There's a person or team who can still change things.
On the trust side,
@tokenforge holds an ISO 27001 certificate.
ยซThat's not a smart contract audit. It's a certification for how they run their internal processes and security.ยป
Different thing, still worth mentioning.
And public visibility is limited.
ยซThey keep some repos open, like "tf-contract-registry", but there's no full-suite audit out there covering issuance, utility, and payment contracts all together.ยป
If you go looking for one, you won't find it yet.
So where does that leave things?
ยซOne contract audited and clean.
Broader system not yet covered.
A real certification, but for process, not code.ยป
That's not a red flag on its own, plenty of institutional platforms look like this early on.
But it's not the full picture either, and you should know the difference before you repeat "TokenForge is audited" like it settles everything.
What do you want to see audited next?