docs(security): list audit reports with auditors, dates and scope

[youssefea]

What changed? Why?

Adds a table to the Audits section of Reliability and Liveness that lists each published third-party audit report for the Base Stack, with its date, auditor, scope, and report link. The existing section only linked the audit directories, so readers could not see named auditors, dates, or scope without opening each repository.

Closes knowledge gap gap-20260924-protocol-audits-named-auditors-dates-scope: "Which third-party audits cover Base's protocol, bridge/portal, Azul proof contracts (AggregateVerifier, TEE/ZK verifiers), sequencer/base-builder and B20 precompiles, and where is the public audit list with auditors, dates, scope and remediation status?" Logged in the Base knowledge gaps log. Tracked in Linear DEVREL-859.

Notes to reviewers

Primary sources for each fact:

• base/contracts rows (dates, Cantina, scope): base/contracts audits/README.md. That index also lists reviewed commits, which the new text points to rather than duplicating.
• base/base rows: cover pages of beryl-b20.pdf and beryl-precompiles-storage.pdf (Cantina, August 14, 2026), cobalt-b20.pdf (Cantina, September 10, 2026), cobalt-dynamic-upgrades.pdf (Cantina, September 19, 2026).
• Azul Immunefi competition dates (April 21 to May 4, 2026): base/base audits/azul/README.md and reports.immunefi.com/base.
• "Fixed or acknowledged" remediation wording: each Cantina report's Security Review Summary and per-finding responses.

Before merge, the Base protocol security team should confirm:

• That publishing this consolidated table and its remediation wording is approved.
• The scope labels for the base/base reports. They are paraphrased from the report titles ("Precompiles Src", "Base Precompile Macros & Storage", "Precompiles Diff", "Base Dynamic-Upgrades").
• That the table does not need to cover other components. It does not claim to be exhaustive, and it makes no statement about audits of the sequencer or base-builder because no public source covers those.

Mixed date sources: base/contracts dates come from the repo index and match the review start dates in the reports. base/base dates are the report cover dates. The text says which is which.

How has it been tested?

• node scripts/lint-mdx.js --files-from=<changed files>: 0 errors, 0 warnings.
• node scripts/validate-docs-structure.js: fails only on a redirect for /upgrades/denim/eip-8130 that already fails on master. This PR does not touch docs/docs.json.
• curl -sIL returned 200 for every external link added (all 11 report PDFs, the base/contracts index, and Immunefi).

Screenshots

N/A (text-only change)

Generated with Toshi

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
base	🟢 Ready	View Preview	Oct 15, 2026, 3:02 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[linear]

DEVREL-859