Deep Dive
1. Critical Security Audit Findings (17 May 2026)
Overview: An independent security review by Meta Financial AI uncovered critical vulnerabilities and centralization risks in EVAA's live smart contracts. These issues directly impact the safety of user funds.
The audit identified a liquidation blocking bug (GitHub Issue #2) that has remained unaddressed for over 15 months. This flaw allows borrowers to prevent the liquidation of their undercollateralized positions, potentially leaving lenders with bad debt. Furthermore, the code implements a 30-second upgrade timelock and single admin control, contrary to industry standards and the project's own documentation which suggests a multisig. This gives one address the power to alter contract rules almost instantly.
What this means: This is bearish for EVAA because it exposes lenders to higher risk of loss and places immense trust in a single entity. While the protocol is functional with real usage, these unresolved code-level issues represent a significant security and governance liability for all participants. ()
2. Token Unlock Postponement & Roadmap Focus (24 March 2026)
Overview: The development team announced the postponement of a scheduled token unlock originally set for early April 2026. This decision was made to avoid potential sell pressure and to align with better market conditions for token holders.
Concurrently, the team outlined its development priorities, which include improving user experience (UX), forging more integrations, deepening liquidity pools, and expanding into new markets. This suggests a strategic pivot from mere token distribution to strengthening the protocol's core utility and accessibility.
What this means: This is neutral to cautiously bullish for EVAA because it shows proactive management of tokenomics to protect holder value. The renewed focus on product development could lead to a smoother, more widely adopted platform if executed well, though it does not directly address the critical code vulnerabilities highlighted in the audit. ()
Conclusion
EVAA's development trajectory is marked by a tension between rapid ecosystem growth on TON and foundational codebase risks that challenge its decentralization and security promises. The protocol's decision to delay unlocks and improve UX is constructive, but the unresolved critical audit findings remain a major overhang. Will the team prioritize and resolve the long-standing security vulnerabilities to match its ambitious growth plans?