> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tori.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Security FAQ

> Frequently asked questions about security

## Smart Contract Security

### Have the smart contracts been audited?

**Yes.** All Tori smart contracts are independently audited by [Sherlock](https://sherlock.xyz) and [Nethermind](https://www.nethermind.io/), two leading smart contract security firms. Sherlock protects over **\$50 billion** in assets across Web3.

<Card title="View Audit Reports" icon="file-contract" href="/security/audits">
  Read our complete audit reports and findings
</Card>

### Is there a bug bounty program?

**Yes.** We maintain an active bug bounty program. Security researchers can earn rewards for responsibly disclosing vulnerabilities.

| Severity | Reward Range        |
| -------- | ------------------- |
| Critical | Up to \$1,000,000   |
| High     | \$10,000 - \$50,000 |
| Medium   | \$1,000 - \$10,000  |
| Low      | Up to \$1,000       |

Report vulnerabilities to: [security@tori.finance](mailto:security@tori.finance)

### How often are contracts audited?

| Event                  | Action                         |
| ---------------------- | ------------------------------ |
| **Initial deployment** | Full comprehensive audit       |
| **Major updates**      | Re-audit of changed components |
| **New features**       | Audit before deployment        |
| **Ongoing**            | Continuous bug bounty coverage |

### Are the contracts upgradeable?

Yes. Contracts use upgradeable proxy patterns to allow security fixes and improvements.

**Safeguards in place:**

* Multi-signature approval required for upgrades
* Time locks on sensitive changes
* Transparent upgrade process

***

## Asset Security

### Where are assets held?

<CardGroup cols={2}>
  <Card title="On-Chain Assets" icon="link">
    **Audited smart contracts** with multi-signature controls and time locks
  </Card>

  <Card title="Off-Chain Assets" icon="building">
    **Qualified institutional custodians** with segregated accounts
  </Card>
</CardGroup>

### Is trUSD/strUSD insured?

**No.** trUSD and strUSD are not insured by:

* Any government agency (like FDIC)
* Private insurance companies

This is standard for DeFi tokens. Only use amounts appropriate to your risk tolerance.

Protocol cover for the Tori pre-deposit vault is available separately through [Nexus Mutual](https://app.nexusmutual.io/cover/product/446), covering smart contract and oracle risk. You can purchase it directly on the Nexus Mutual app.

### Who are the custodians?

We work exclusively with qualified institutional custodians and partners that meet our rigorous due diligence standards:

| Requirement      | What We Look For                                  |
| ---------------- | ------------------------------------------------- |
| **Regulation**   | Licensed and regulated entities                   |
| **Track Record** | Proven history in asset management and custody    |
| **Security**     | SOC 2 compliance and/or industry-leading security |
| **Segregation**  | Full segregation of assets                        |

### Can the team access protocol assets?

The protocol is designed with strict access controls:

| Control             | Implementation                                 |
| ------------------- | ---------------------------------------------- |
| **Multi-signature** | Critical operations require multiple approvals |
| **Time locks**      | Delays on sensitive parameter changes          |
| **Role separation** | Limited access based on function               |

***

## Verification & Transparency

### How can I verify reserves?

**Three ways to verify:**

<Steps>
  <Step title="Proof of Reserves">
    Check real-time attestations from Accountable for independent, third-party verification
  </Step>

  <Step title="On-Chain Data">Verify smart contract balances directly on Etherscan</Step>
  <Step title="Token Supply">Compare total trUSD supply against backing</Step>
</Steps>

### How often are reserves verified?

**Real-time.** Proof of Reserves from Accountable updates continuously, not monthly or quarterly like traditional finance.

### Where can I see the Proof of Reserves?

| Source          | What You'll Find                    |
| --------------- | ----------------------------------- |
| **Tori app**    | Dashboard showing live backing data |
| **Accountable** | Independent attestation platform    |
| **Etherscan**   | On-chain contract balances          |

***

## Monitoring & Incident Response

### How is the protocol monitored?

**Hypernative** provides AI-powered 24/7 threat detection:

| Capability                  | Description                                   |
| --------------------------- | --------------------------------------------- |
| **Continuous surveillance** | Automated monitoring of all protocol activity |
| **Anomaly detection**       | AI identifies unusual patterns in real-time   |
| **Instant alerting**        | Immediate notification on suspicious activity |
| **Risk scoring**            | Ongoing assessment of protocol risk levels    |

### What happens during a security incident?

Our incident response process:

<Steps>
  <Step title="Detection">Automated monitoring identifies the issue immediately</Step>
  <Step title="Assessment">Rapid triage to understand severity and potential impact</Step>
  <Step title="Containment">Immediate steps to limit damage (may include pausing operations)</Step>
  <Step title="Communication">Transparent updates through official channels</Step>
  <Step title="Remediation">Fix the underlying issue</Step>
  <Step title="Post-Mortem">Analysis and implementation of preventive measures</Step>
</Steps>

### Can the protocol be paused?

**Yes.** Emergency pause capabilities exist for critical situations. This is a protective measure to prevent further damage during security incidents.

***

## Protecting Yourself

### How can I stay safe?

<CardGroup cols={2}>
  <Card title="Verify URLs" icon="link">
    Only use [app.tori.finance](https://app.tori.finance). Bookmark it to avoid phishing sites.
  </Card>

  <Card title="Verify Contracts" icon="file-code">
    Check addresses on our [Contracts page](/resources/contracts) before interacting.
  </Card>

  <Card title="Secure Your Wallet" icon="key">
    Never share private keys or seed phrases with anyone. Ever.
  </Card>

  <Card title="Stay Cautious" icon="shield">
    Be skeptical of DMs, airdrops, and "support" messages.
  </Card>
</CardGroup>

### What are common scams to watch for?

| Scam Type          | Red Flags                                   |
| ------------------ | ------------------------------------------- |
| **Phishing sites** | Wrong URL, requests for seed phrase         |
| **Fake support**   | DMs on social media claiming to be Tori     |
| **Airdrop scams**  | "Free tokens" requiring wallet connection   |
| **Impersonation**  | Accounts pretending to be Tori team members |

### What will Tori team NEVER do?

The Tori team will **NEVER**:

* ❌ Ask for your seed phrase or private keys
* ❌ DM you first on social media
* ❌ Ask you to send tokens to "verify" your wallet
* ❌ Offer exclusive deals via DM
* ❌ Ask you to download software outside the official app

### What security features should I use?

| Recommendation             | Why                                           |
| -------------------------- | --------------------------------------------- |
| **Hardware wallet**        | Best security for larger amounts              |
| **Transaction simulation** | Preview what will happen before signing       |
| **Address whitelisting**   | Prevent accidental sends to wrong addresses   |
| **MFA on exchanges**       | If you're bridging from centralized exchanges |

***

## Reporting Issues

### How do I report a security vulnerability?

**Email:** [security@tori.finance](mailto:security@tori.finance)

**Please include:**

* Clear description of the vulnerability
* Steps to reproduce
* Proof of concept (if applicable)
* Potential impact assessment

<Note>
  **Responsible disclosure:** Please don't publicly disclose vulnerabilities before they've been addressed. We commit to
  acknowledging reports within 24 hours.
</Note>

### How do I report a scam or phishing attempt?

Email [security@tori.finance](mailto:security@tori.finance) with:

* Screenshots of the scam
* URLs involved
* Any other relevant details

Reporting helps us protect the community.

### I think my wallet was compromised

If you suspect unauthorized activity:

1. **Stop** - Don't make any more transactions
2. **Move assets** - Transfer remaining tokens to a new, secure wallet
3. **Report** - Create a ticket on our [Discord](https://discord.gg/torifinance) for support
4. **Document** - Save transaction hashes and screenshots

***

## Security Approach

### How does Tori approach security?

Security is **multi-layered**. We don't rely on any single protection:

| Layer               | How It Helps                                            |
| ------------------- | ------------------------------------------------------- |
| **Audits**          | Professional review identifies issues before deployment |
| **Bug bounty**      | Ongoing incentive for researchers to find issues        |
| **24/7 monitoring** | Real-time detection of anomalies and threats            |
| **Multi-sig**       | Critical operations require multiple approvals          |
| **Reserve fund**    | Buffer against adverse conditions                       |

### What are the limitations?

No system can guarantee perfect security. We're transparent about this:

* Audits are point-in-time assessments
* New attack vectors can emerge
* DeFi is experimental by nature

This is why we use **multiple overlapping protections** rather than relying on any single measure.

See [Risk Disclosures](/resources/risks) for complete information.

***

## More Questions?

For security-related inquiries: [security@tori.finance](mailto:security@tori.finance)

For general support: Join our [Discord](https://discord.gg/torifinance)

<CardGroup cols={2}>
  <Card title="Security Overview" icon="shield" href="/security/overview">
    Our comprehensive security approach
  </Card>

  <Card title="Audit Reports" icon="file-contract" href="/security/audits">
    View detailed audit reports
  </Card>

  <Card title="Risk Disclosures" icon="triangle-exclamation" href="/resources/risks">
    Understand all risks involved
  </Card>

  <Card title="Contracts" icon="file-code" href="/resources/contracts">
    Verify contract addresses
  </Card>
</CardGroup>