> For the complete documentation index, see [llms.txt](https://docs.syndromics.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.syndromics.xyz/architecture/security.md). # Security programme The protocol follows the Morpho Blue playbook: keep the core small and immutable, verify it formally, audit it independently, contest it publicly, and grow exposure only as evidence accumulates. ## Testing | Layer | Tooling and scope | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Unit and integration | Foundry. Every contract, every path, every revert reason. 49 tests across settlement, repayment, liquidation, refinancing and governance; the file-by-file breakdown is on the [Deployment](/architecture/deployment.md) page. | | Invariant and fuzz | Foundry invariant suite. Solvency invariants (sum of slice claims never exceeds escrow plus proceeds), accrual monotonicity, nonce and partial-fill consistency, HF monotonicity under price moves, auction curve bounds. | | Mutation testing | Confirms the suite catches injected faults. | | Fork tests | Against Robinhood Chain forks with the live Chainlink feeds, USDG and Morpho vaults. | | Formal verification | Specifications for `LoanSettlement` and `OfferBook`: no path disburses without escrow, no path releases collateral with debt outstanding, no double-fill of an offer. | The full suite runs on every change and must be green before a release is tagged. ## Audits, contest and bounty * Every release of the contract set goes through **independent audit** before it reaches Robinhood Chain, followed by a **public contest**. Reports are linked from this page as they are published. * A **bug bounty** is live and scales with protocol exposure. Findings reported responsibly are eligible from the day they are submitted. * Release criterion: no unresolved high or critical findings. ## Operational controls | Control | Detail | | --------------------- | ---------------------------------------------------------------------------------------------------------------------- | | Immutable core | `LoanSettlement`, `OfferBook`, `PositionNFT` and the auctions have no proxy and no admin. | | Timelocked parameters | All parameters behind a multisig with a timelock; every change emits an event and is published with a rationale. | | Emergency pause | Applies to **new loans and liquidations only**. Repayment and post-repayment collateral withdrawal are never pausable. | | No fund access | The multisig cannot move escrowed collateral, lender principal or vault balances. | | Staged caps | Per-token exposure caps start conservative and grow with liquidation and repayment data. | | Verified bytecode | Reproducible builds; source verified on Blockscout for every deployment. | ## Threat model highlights | Threat | Defence | | ---------------------------------- | --------------------------------------------------------------------------------------------- | | Forged or replayed offers | EIP-712 domain with chain ID; per-maker nonce bitmaps; partial-fill accounting per offer hash | | Malicious relayer | Offers re-verified on-chain; a relayer can withhold but not alter | | Oracle manipulation | Guarded Chainlink feeds and streams with cross-check; move caps; exact-token pricing | | Wrapper or derived-rate collateral | Not accepted; markets are configured with the escrowed token's own feed | | Weekend gap exploitation | Session haircuts; bounded auction floors; lender opt-outs | | Sequencer outage or censorship | Post-outage grace; L1 delayed inbox for every function | | Vault failure in idle capital | Opt-in only; single whitelisted vault; allowance-based; in audit scope | | Governance key compromise | Timelock gives time to react; keys cannot move funds or pause repayment | ## Disclosure Report vulnerabilities to . Please do not open public issues for security findings. Responsible disclosures are acknowledged within one business day and are eligible for the bounty. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.syndromics.xyz/architecture/security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.