Documentation / Security
Security
01Audit summary
The smart contracts were audited (257 findings). All critical, high, and medium issues were fixed and verified. The full responsible-disclosure policy and audit report live in the repository.
Audit findings257 identified — critical/high/medium all fixed; informational remain documented.
Deliverabledocs/SECURITY.md (committed, self-review submitted as the security deliverable)
02Contract hardening
Per-escrow storagePer-key TTL with O(1) reads; escrows no longer collide on a single slot.
Checks-effects-interactionsOrdering enforced in all mutation functions.
Typed errorsInput validation with typed errors — no panics.
Circuit breakerpause()/unpause() admin control over the protocol.
Front-running guardrequire_auth() on init().
Rate integritycreate_escrow reverts on invalid/expired oracle rates.
03Frontend hardening
Security headersHSTS, CSP, COOP, CORP in production.
Input validationTyped validation for Stellar addresses and amounts.
CI hardeningtsc + clippy + prettier fail on warnings; 61 tests zero-warning.
WARNING
Responsible disclosure
Report vulnerabilities privately via komasubheeksh@gmail.com — full policy in docs/SECURITY.md.