Legal & Compliance
Audit Reports
Independent review of the Mexas smart contract, the quarterly proof-of-reserves reports, and the on-chain record you can check yourself without trusting anyone.
Three things need verifying, not one
A stablecoin makes separate promises, and they are verified in completely different ways. Conflating them is how holders get misled, so we keep them apart on this page.
The code
Whether the token contract does what it should and nothing it shouldn’t. Reviewed by an independent security firm, whose report is below.
The token side
How many tokens exist on each network, who holds them, and every transfer ever made. Public, permanent and verifiable by anyone, at any time. Requires trusting nobody.
The reserve side
Whether peso reserves exist and are sufficient to back those tokens. Held at financial institutions, so no blockchain can show it. Established by an independent accounting firm each quarter, with the reports below — which requires trusting the auditor.
Smart contract security audit
| Auditor | CertiK |
|---|---|
| Report | Security Assessment — final report 12 May 2026 (preliminary findings 14 October 2025) |
| Scope | contracts/MEXAS.sol in the public mexas-stablecoin repository, at commits 02a21ea and bb91ec3 |
| Methods | Formal verification, manual review, static analysis |
| Findings | 0 critical, 0 major, 0 medium. 1 minor, acknowledged. 2 centralization findings, mitigated by multisig ownership. |
The same report is listed on CertiK Skynet, so you can confirm it came from the auditor rather than taking our copy on trust.
What the findings say
- Two centralization findings concern the owner role, which can upgrade the contract, mint, block an address and destroy its balance, and pause transfers — the same powers set out in the whitepaper. On every network, ownership has been moved to a multisig wallet, so no single key can use them. CertiK’s view is that this reduces the risk but does not eliminate it. It also recommended a timelock on privileged actions and advance notice of upgrades; neither is in place today.
- One minor finding is a coding-style issue: a parameter name in
permitshadows the contract’sownerfunction. The team acknowledged it and did not change the code.
Is the audited code what is actually deployed?
Yes. An audit only means something if it covers the contract you hold, so we checked. The verified source of the deployed implementation is identical to contracts/MEXAS.sol at the audited commits, and every network — Ethereum, Arbitrum One, Avalanche C-Chain, Base and BNB Smart Chain — runs that same contract logic. Anyone can repeat the comparison: the source is verified on-chain and the repository is public.
An audit is a review at a point in time, not a guarantee. It does not certify that the code is free of defects, and it says nothing about the reserves. If the implementation is ever upgraded, the new code is not covered by this report.
Proof of reserves
Every quarter, the accounting firm Ferrer & Asociados checks the pesos held in the reserve bank accounts against the number of Mexas in circulation, summed across every network, at 23:59:59 (UTC−6) on the last day of the quarter. It also reconciles the quarter’s bank movements against the matching on-chain movements. Each report is published here in full, in the Spanish original.
| Quarter | Snapshot | MEX in circulation | Peso reserves (MXN) | Coverage | Report |
|---|---|---|---|---|---|
| Q1 2026 | 31 Mar 2026 | 8,132,290.13 | 12,489,352.98 | 153.58% | |
| Q4 2025 | 31 Dec 2025 | 8,642,290.13 | 12,804,755.05 | 148% | |
| Q3 2025 | 30 Sep 2025 | 27,519,955.56 | 31,420,426.56 | 114% | |
| Q2 2025 | 30 Jun 2025 | 67,120,708.89 | 70,240,000.32 | 105% | |
| Q1 2025* | 31 Mar 2025 | 45,274,106.48 | 47,625,262.57 | 105% | |
| Q4 2024* | 31 Dec 2024 | 555,117 | 1,896,340 | 342% |
Figures and coverage as stated in each report. Coverage is peso reserves divided by MEX in circulation. *Liquid Network only: the EVM deployments began in April 2025, and every report from Q2 2025 onward covers all networks.
What counts as “in circulation”
Only tokens that have been released against pesos. Tokens minted but still held by the issuer have never been sold, are not in circulation and need no backing, which is why each network’s total supply on its block explorer is larger than the circulating figure above. The reports list both, network by network.
What these reports do not tell you
- They are not a financial-statement audit. The reports say so themselves: they are not an audit of the issuer’s financial statements, nor a certification of its general solvency.
- They rely on information the issuer supplies. The firm works from bank statements and financial statements provided by the issuer, plus public blockchain data. Bank balances are not public, so on the reserve side you are trusting the auditor.
- Each one is a snapshot. A report shows the position at one moment at the end of the quarter. It says nothing about the days in between.
What you can verify right now
The token side of the ledger is already fully public. Every deployment below is open to inspection by anyone, at any time, with no permission needed and no report to wait for.
-
Ethereum Etherscan ↗Contract
0x6E8B146AF16429b037ecE5943F3c0E5f412ddFA7 -
Arbitrum One Arbiscan ↗Contract
0xc4c2EdE4F6fD623ACc86C492BDF099b3bA2B8303 -
Avalanche C-Chain Snowtrace ↗Contract
0x6E8B146AF16429b037ecE5943F3c0E5f412ddFA7 -
Contract
0xc4c2EdE4F6fD623ACc86C492BDF099b3bA2B8303 -
Contract
0x405E5F9C7D6F6E9f03a5b64e275f374507734fD6 -
Liquid Network Blockstream ↗Asset ID
26ac924263ba547b706251635550a8649545ee5c074fe5db8d7140557baaf32e
Check every character, and the network. Each network has its own address, and the same address can appear on more than one network as a different contract. Counterfeit tokens are routinely deployed at addresses that match a real one at the first and last few characters — all most wallets show you. Take these from this website, never from a message, a reply or an advertisement. How to verify →
Questions
If you are an exchange, custodian or institutional counterparty and need diligence material beyond these reports, contact us directly: contact@mexas.io. Common questions are answered in the FAQs.