> For the complete documentation index, see [llms.txt](https://docs.useicaria.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.useicaria.xyz/architecture/security.md). # Security programme How the contracts and the services get secured, tested and watched. Security here follows from the design: logic that cannot be changed, very little that is privileged, and a band that caps how far almost any failure can travel. What the programme has to add is pressure on whatever surface remains, and continuous attention to it. ## Audits Two independent audits happen before mainnet exposure grows past the guarded caps. One firm focuses on the economics and the pricing logic, meaning the spread formula, share accounting and band enforcement, while the other covers the contract set as a whole. Reports go out unredacted. Anything later that touches settlement logic becomes a new deployment with a review of its own, whereas parameter changes do not get reviewed that way, which is much of the reason behaviour is kept in parameters to begin with. ## The invariant and fuzzing suite Promises the protocol makes are written as machine-checked properties in the Foundry suite, run in CI on each commit and fuzzed without pause: | Invariant | Meaning | | ------------------- | --------------------------------------------------------------------------------------------------- | | Band safety | Whatever state, regime or parameter set the fuzzer reaches, no fill lands outside the oracle band | | Share monotonicity | No swap lowers value per share, and rounding on mint and burn always favours the vault | | Withdrawal liveness | `withdraw` works in every vault state, `HALTED` and `RETIRED` included, and works with the pause on | | Inventory bounds | Quoting alone can never carry inventory past the band | | Conservation | Every fill conserves value exactly across trader, vault or maker, and `FeeCollector` | | Decimals | The 6-and-18 decimal split holds at both extremes of size | Oracle failures are drilled as first-class scenarios rather than assumed away: stale rounds, a paused feed, a stream and feed that disagree, 25% jumps and sequencer restarts each have their expected halt behaviour asserted. ## Bug bounty From mainnet onward a public programme runs on an Immunefi-style platform, with the highest tier reserved for anything that breaks one of the invariants above. Scope includes the quote service and the SDK, because a client that talks a user into signing something is a real attack even where the chain would have enforced correctly. ## Operational security * Hardware holds the timelock multisig and guardian keys, in the hands of named signers at published thresholds. Since the guardian can do nothing but pause and unpausing is timelocked, a compromised guardian produces denial of quoting rather than loss. * No service holds a key capable of touching funds. Hot keys in this system belong to makers alone, who carry their own key risk and whose worst case the band already bounds. * Alerts fire on compressed band margins, oracle divergence, saturated skew and abnormal fill patterns. Every incident runbook opens on the same instruction, pause quoting, because pausing is guaranteed to do no harm. ## Disclosure Vulnerability reports go to , which publishes a PGP key. Public post-mortems follow every incident within 14 days, and whatever change results lands through the timelock citing that post-mortem as its reason. Credibility for a venue like this is its [transparency commitments](/transparency/commitments.md) surviving contact with a bad day, and this page is where that gets tested. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.useicaria.xyz/architecture/security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.