Security & Audit

Audit status, scope, and responsible disclosure.

Nester's smart contracts run on Stellar testnet today and have not yet been audited. Before any mainnet launch they will go through an external audit; this page keeps a public record of that status, the contracts in scope, and a clear path for security researchers to report issues.

Smart Contract Audit

Pending

Not yet audited — no external audit has been commissioned yet. A completed external audit is a hard requirement before mainnet; its findings will be triaged by severity, and critical and high issues block launch.

When the review is complete, this section will be updated with the audit firm's name, the completion date, and a link to the published report.

Contracts in Scope

  • vault
  • vault_token
  • allocation_strategy
  • yield_registry
  • nester
  • treasury
  • timelock

Threat Model

Read the threat model

The full threat model documents trust assumptions, attacker capabilities, and the mitigations for each contract. Key areas under review:

  • Privilege escalation through admin or governance paths
  • Reentrancy in deposit, withdraw, and rebalance flows
  • Integer overflow or precision loss in accounting code
  • Fee manipulation and rounding drift in yield accounting
  • Unsafe cross-contract calls or stale state transitions

Bug Bounty & Responsible Disclosure

We welcome good-faith security research. Please report vulnerabilities privately and give us reasonable time to fix them before any public disclosure — do not open a public GitHub issue for a security report.

GitHub Private Reporting

Open a private advisory under the repository's Security tab.

Report a vulnerability ↗
  • • We acknowledge reports within 48 hours and keep you updated through triage.
  • • Safe harbor: we won't pursue legal action against good-faith research.
  • • Recognition: valid reports are credited in our Hall of Fame. We do not currently run a paid bounty, but we publicly recognize every valid report.
Read the full security policy