Smart contract security
Have the smart contracts been audited?
Yes. All Tori smart contracts are independently audited by Sherlock and Nethermind, two leading smart contract security firms. Sherlock has audited protocols securing over $50 billion in assets across Web3.View audit reports
Both reports in full, with dates and findings
Is there a bug bounty program?
Yes. Rewards scale with severity, up to $1,000,000 for a critical finding. The full reward table, scope, and process are on the audits page. Report vulnerabilities to [email protected].How often are contracts audited?
Contracts get a full audit before initial deployment, changed components are re-audited on major updates, and new features are audited before they ship. The bug bounty covers everything in between.Are the contracts upgradeable?
Yes, the contracts use upgradeable proxy patterns so security fixes can ship. An upgrade cannot happen quietly: it executes only through the 24-hour timelock, queued and executed by the 3-of-5 Safe, so any upgrade is visible on-chain for a full day before it takes effect.Asset security
Where are assets held?
On-chain assets stay in audited contracts whose privileged operations need a multisig quorum. Off-chain reserves are held by vetted institutional custodians in segregated accounts. Backing and reserves explains the full picture, and the role matrix shows exactly which keys can move what.Is trUSD/strUSD insured?
No. trUSD and strUSD are not insured by:- Any government agency (like FDIC)
- Private insurance companies
Who are the custodians?
We do not publish custodian names. What matters is checkable anyway: reserve balances held with them are covered by Accountable’s independent attestations, and collateral can only move to a custody address that was registered on-chain through the 24-hour timelock. Every custodian and partner we use is licensed and regulated, has an established custody track record, meets SOC 2 or equivalent security standards, and holds assets in fully segregated accounts.Can the team access protocol assets?
No single person can. Every privileged function sits behind a named role: critical operations need a 3-of-5 Safe quorum, custody transfers can only go to timelocked, pre-registered addresses, and the operational keys can each do exactly one job. The role matrix lists every role, holder, and function, and all of it is readable on-chain.Verification and transparency
How can I verify reserves?
Three ways to verify:1
Proof of Reserves
Read the live, independent attestations from Accountable at tori.accountable.capital
2
On-chain data
Verify smart contract balances directly on Etherscan (contract addresses)
3
Token supply
Compare total trUSD supply against attested backing
How often are reserves verified?
Continuously. Proof of Reserves from Accountable updates in real time, not monthly or quarterly like traditional finance.Where can I see the Proof of Reserves?
Monitoring and incident response
How is the protocol monitored?
Hypernative watches the protocol around the clock. Its models flag anomalies as they happen, from unusual transactions to known attacker addresses, alert the team immediately, and keep a running risk score on the protocol. Detection and first response are automated.What happens during a security incident?
Our incident response process:1
Detection
Automated monitoring is designed to identify issues immediately
2
Assessment
Rapid triage to understand severity and potential impact
3
Containment
Immediate steps to limit damage (may include pausing operations)
4
Communication
Updates through official channels
5
Remediation
Fix the underlying issue
6
Post-mortem
Analysis and preventive measures
Can the protocol be paused?
Yes. Mint and redeem can be shut off in a single transaction by the Gatekeeper role, which exists precisely so containment never waits on a multisig quorum. Details are in the role matrix.Protecting yourself
How can I stay safe?
Verify URLs
Only use app.tori.finance. Bookmark it to avoid phishing sites.
Verify contracts
Check addresses on our Contracts page before interacting.
Secure your wallet
Never share private keys or seed phrases with anyone. Ever.
Stay cautious
Be skeptical of DMs, airdrops, and “support” messages.
What are common scams to watch for?
What will the Tori team never do?
The Tori team will never:- Ask for your seed phrase or private keys
- DM you first on social media
- Ask you to send tokens to “verify” your wallet
- Offer exclusive deals via DM
- Ask you to download software outside the official app
What security features should I use?
Reporting issues
How do I report a security vulnerability?
Email: [email protected] Please include:- Clear description of the vulnerability
- Steps to reproduce
- Proof of concept (if applicable)
- Potential impact assessment
Responsible disclosure: Please don’t publicly disclose vulnerabilities before they’ve been addressed. We commit to
acknowledging reports within 24 hours.
How do I report a scam or phishing attempt?
Email [email protected] with:- Screenshots of the scam
- URLs involved
- Any other relevant details
I think my wallet was compromised
If you suspect unauthorized activity:- Stop - Don’t make any more transactions
- Move assets - Transfer remaining tokens to a new, secure wallet
- Report - Create a ticket on our Discord for support
- Document - Save transaction hashes and screenshots
Security approach
How does Tori approach security?
No single protection is trusted on its own. Audits catch issues before deployment, the bounty pays researchers to keep looking afterward, Hypernative monitors production in real time, multisigs and the timelock constrain every privileged key, and the reserve fund buffers adverse conditions. The security overview walks through each layer.What are the limitations?
No system can guarantee perfect security. We’re transparent about this:- Audits are point-in-time assessments
- New attack vectors can emerge
- DeFi is experimental by nature
More questions?
For security-related inquiries: [email protected] For general support: Join our DiscordSecurity overview
Every layer of the stack, in one place
Audit reports
Dates, PDFs, and the bounty table
Risk disclosures
Read these before depositing
Contracts
Verify every address on Etherscan