- New audit found no significant vulnerabilities in Mullvad’s GotaTun
- Minor issues identified are already resolved, says Mullvad
- GotaTun replaced the old WireGuard implementation in December
Mullvad VPN’s WireGuard implementation, GotaTun, has been given the green light in a security audit by independent auditors, reporting no significant vulnerabilities.
Written in the Rust programming language, GotaTun is a user-space implementation of the WireGuard network tunneling protocol that Mullvad introduced as an open source replacement for his previous Go-based implementation.
Implemented in December, shortly before Mullvad’s completion removing the OpenVPN protocol, it has so far brought faster performance, longer battery life on mobile devices, and far fewer app crashes, which makes the application much more stable overall.
Article continues below
But even the best VPNs can’t just claim their new code is free of security flaws; a third-party auditor is needed to verify that the code is up to par.
What the audit found – and what wasn’t done
Between January 19 and February 15, Gothenburg-based Assured Security Consultants conducted a brief code review of GotaTun to test its entire configuration, except for the command line interface and specific features. DAITA code.
The code was clear, reassuring Mullvad users that the VPN has accurately and securely implemented the WireGuard protocol in their native programming language.
“Based on our code review, GotaTun does not present any major vulnerabilities,” the auditors conclude in their report.
This will be welcomed by users who previously experienced crashes due to the previous non-Rust implementation, who can now rest assured that the new, sleeker user experience comes with continued levels of security.
Our WireGuard implementation, GotaTun, was recently audited by Assured Security Consultants. Two identified low severity issues were resolved before the end of the audit. No major vulnerabilities were found. To learn more, click here: https://t.co/ouHlGhr8JgMarch 6, 2026
Indeed, Mullvad previously reported that 85% of all crashes recorded on its Android app were directly related to conflicts between Mullvad’s Rust code and WireGuard’s Go implementation.
That’s when the Privacy VPN team rewrote Rust’s WireGuard implementation to fit their stack: GotaTun, or “the future of WireGuard,” as Mullvad called it, whose implementation virtually eliminated these issues, with the crash rate on Android dropping from 0.4% to around 0.01%.
The audit further confirmed that Mullvad and its users have reason to celebrate and that crash fears are now unfounded: the code is fit for purpose.
Minor defects found
It is important to note, however, that the audit results were not flawless. Two minor issues were identified and flagged for fix, where Mullvad’s implementation of Rust did not perfectly follow the official WireGuard protocol.
A padding error indicated that the format of the numeric data sent by the Rust implementation was not consistent with the protocol specifications.
A second issue also highlighted that although the WireGuard protocol requires a random number to be assigned, Mullvad did not use a completely random method, but a more predictable method to generate the number.
Finally, some parts of the code are mainly maintained by very small teams, consisting of one or two people. While this poses no security risks currently, it raises long-term quality and maintenance concerns because statistically larger teams tend to find more bugs and reduce potential code flaws in the future, auditors said.
Mullvad said most of these recommendations were corrected before the results were released, a claim that will likely be verified in their next audit.
However, for current and potential Mullvad users, these current results reinforce Mullvad’s status as a VPN that prioritizes user privacy and anonymity, continuing to improve its core principles through meaningful third-party reviews.
And it looks like, for now, no app crashes will stop it from achieving its goal.
Follow TechRadar on Google News And add us as your favorite source to get our news, reviews and expert opinions in your feeds. Make sure to click the Follow button!
