> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serializedaudit.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Understanding Results

> Every field in the response and what it represents.

A response wraps the result under an `audit` object. The fields documented below are the **complete public response**: exactly what an API call returns, and the only fields you should build against. The [endpoint reference](/api-reference/audit-contract) shows them with example payloads; this page explains what each one represents.

## Verdict

These fields carry the safety decision.

<ResponseField name="isSafe" type="boolean">
  The overall verdict, your decision boundary. `true` means no holder-harming risk was active at audit time. It combines the token verdict and, when present, the pool-hook verdict.
</ResponseField>

<ResponseField name="isTokenSafe" type="boolean">
  The verdict for the token contract on its own, ignoring any associated pool hook.
</ResponseField>

<ResponseField name="isHookSafe" type="boolean | null">
  The verdict for the associated Uniswap v4 pool hook, or `null` when the token has no hook.
</ResponseField>

<ResponseField name="description" type="string">
  A short, human-readable explanation of the verdict, safe to display to your users.
</ResponseField>

<ResponseField name="vulnerabilities" type="array">
  The detected risks. Empty when the contract is safe. Each item describes one risk; see [Risk Categories](/risk-categories) for the full object.
</ResponseField>

## Identity

| Field     | Type           | Represents                                  |
| --------- | -------------- | ------------------------------------------- |
| `name`    | string \| null | Token name.                                 |
| `symbol`  | string \| null | Token symbol.                               |
| `address` | string         | The audited contract address (echoed back). |
| `chain`   | string         | The chain symbol (echoed back).             |

## Source

| Field        | Type           | Represents                                                                                                                                                                                                        |
| ------------ | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `sourceType` | string         | How the analyzed code was obtained: `verified` (published source), `decompiled` (reconstructed from on-chain bytecode), `b20` (a Base native B20 token with no bytecode to read; classified on-chain), or `none`. |
| `b20Flags`   | object \| null | Live on-chain flag snapshot for a `b20` token (transfer policies, paused features, rebase multiplier, supply cap). `null` on every other `sourceType`.                                                            |

## Proxy

| Field                   | Type           | Represents                                                                                     |
| ----------------------- | -------------- | ---------------------------------------------------------------------------------------------- |
| `isProxy`               | boolean        | Whether the contract is a proxy. When `true`, the verdict already reflects its implementation. |
| `implementationAddress` | string \| null | For a proxy, the implementation that was audited.                                              |

## Pool hook (Uniswap v4)

| Field         | Type           | Represents                                                                                                                 |
| ------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------- |
| `hookAddress` | string \| null | Address of the associated pool hook, when present.                                                                         |
| `hookAudit`   | object \| null | The hook's own audit: `isSafe`, `description`, `vulnerabilities`, `address`, `isDecompiled`. `null` when there is no hook. |

## Timing & versioning

| Field                      | Type   | Represents                                                                                           |
| -------------------------- | ------ | ---------------------------------------------------------------------------------------------------- |
| `createdAt`                | string | ISO timestamp of when this audit was produced.                                                       |
| `auditSystemVersion`       | string | The version that produced this result; gate new fields on a minimum version.                         |
| `latestAuditSystemVersion` | string | The latest version. If it differs from `auditSystemVersion`, the result refreshes on the next visit. |

## Verdicts stay current

The verdict reflects the contract's state at the time of your request. A contract flagged unsafe can later become safe, for example once its owner renounces. Re-checking the same contract picks up that change: results re-audit on their own as the contract evolves, and a stale result (`auditSystemVersion` below `latestAuditSystemVersion`) refreshes on the next request.

## Not tradable yet

Only tradable contracts are audited. If no liquidity pool exists for the contract yet, the API returns `404` with `{ "audit": null, "reason": "no_liquidity_pool" }`. Retry once a pool has been created. See [Errors & Status Codes](/errors).