> For the complete documentation index, see [llms.txt](https://docs.ethosis.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ethosis.org/architecture/security.md). # Security practice Ethosis takes its security approach from the Morpho Blue playbook. The core is kept small and immutable, formally verified, independently audited and publicly contested, and exposure is widened only as the evidence justifies it. ## Test coverage | Layer | What is used and what it covers | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Unit and integration | Foundry, covering every contract, every path and every revert reason: 65 tests across origination, repayment, liquidation, refinancing and governance. The per-file breakdown is on the [Deployment](/architecture/deployment.md) page. | | Invariant and fuzz | Foundry's invariant suite, checking solvency (the sum of slice claims never exceeds escrow plus proceeds), monotonic accrual, consistency of nonces and partial fills, monotonic HF under price moves, and the bounds of the auction curve. | | Mutation testing | Verifies that injected faults are caught by the suite. | | Fork tests | Run against forks of Robinhood Chain using the live Chainlink feeds, USDG and Morpho vaults. | | Formal verification | Specifications over `LoanDesk` and `IntentBook`: nothing disburses without escrow, nothing releases collateral while debt remains, and no offer can be filled twice. | Every change runs the whole suite, and a release is tagged only when it is green. ## Audits, contests and the bounty * No release of the contract set reaches Robinhood Chain without an **independent audit**, and each audit is followed by a **public contest**. Reports are linked from this page as they become available. * A **bug bounty** is running, sized in proportion to protocol exposure. Responsibly reported findings qualify from the day they are submitted. * A release ships only with no unresolved high or critical findings. ## Safeguards in operation | Safeguard | What it means | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------ | | Immutable core | `LoanDesk`, `IntentBook`, `SliceToken` and both auctions carry no proxy and no admin. | | Timelocked parameters | Every parameter sits behind a multisig with a timelock. Each change emits an event and is published together with a rationale. | | Emergency pause | Reaches **new loans and liquidations only**. Repayment, and collateral withdrawal after repayment, can never be paused. | | No access to funds | The multisig has no way to move escrowed collateral, lender principal or vault balances. | | Staged caps | Per-token exposure caps begin conservative and are raised as liquidation and repayment data accumulates. | | Verified bytecode | Builds are reproducible, and the source of every deployment is verified on Blockscout. | ## Threats and their answers | Threat | Answer | | ---------------------------------- | --------------------------------------------------------------------------------------------------------- | | Forged or replayed offers | EIP-712 domain including the chain ID; nonce bitmaps per maker; partial fills tracked per offer hash | | A hostile relayer | Offers are re-verified on-chain, so a relayer can withhold but never alter | | Oracle manipulation | Chainlink feeds and streams behind guards and cross-checks; move caps; the exact escrowed token is priced | | Wrapper or derived-rate collateral | Refused outright; each market is configured with its escrowed token's own feed | | Exploiting the weekend gap | Session haircuts, bounded auction floors and lender opt-outs | | Sequencer outage or censorship | A grace period after an outage, and every function reachable through the L1 delayed inbox | | Failure of the idle-capital vault | Opt-in only, one whitelisted vault, allowance-based, and covered by audit | | Compromised governance keys | The timelock buys time to respond, and the keys can neither move funds nor pause repayment | ## Reporting a vulnerability Send security findings to rather than opening a public issue. Responsible disclosures receive an acknowledgement within one business day and are eligible for the bounty. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.ethosis.org/architecture/security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.