> ## Documentation Index > Fetch the complete documentation index at: https://docs.tori.finance/llms.txt > Use this file to discover all available pages before exploring further. # Security FAQ > Frequently asked questions about security ## Smart contract security ### Have the smart contracts been audited? **Yes.** All Tori smart contracts are independently audited by [Sherlock](https://sherlock.xyz) and [Nethermind](https://www.nethermind.io/), two leading smart contract security firms. Sherlock has audited protocols securing over **\$50 billion** in assets across Web3. Both reports in full, with dates and findings ### Is there a bug bounty program? **Yes.** Rewards scale with severity, up to \$1,000,000 for a critical finding. The full reward table, scope, and process are on the [audits page](/security/audits#bug-bounty). Report vulnerabilities to [security@tori.finance](mailto:security@tori.finance). ### How often are contracts audited? Contracts get a full audit before initial deployment, changed components are re-audited on major updates, and new features are audited before they ship. The bug bounty covers everything in between. ### Are the contracts upgradeable? Yes, the contracts use upgradeable proxy patterns so security fixes can ship. An upgrade cannot happen quietly: it executes only through the [24-hour timelock](/security/roles), queued and executed by the 3-of-5 Safe, so any upgrade is visible on-chain for a full day before it takes effect. *** ## Asset security ### Where are assets held? On-chain assets stay in audited contracts whose privileged operations need a multisig quorum. Off-chain reserves are held by vetted institutional custodians in segregated accounts. [Backing and reserves](/solution/backing) explains the full picture, and the [role matrix](/security/roles) shows exactly which keys can move what. ### Is trUSD/strUSD insured? **No.** trUSD and strUSD are not insured by: * Any government agency (like FDIC) * Private insurance companies This is standard for DeFi tokens. Only use amounts appropriate to your risk tolerance. Separately, [Nexus Mutual](https://app.nexusmutual.io/cover/product/446) offers protocol cover for the Tori vault against smart contract and oracle risk. You can purchase it directly on the Nexus Mutual app. ### Who are the custodians? Two separate arrangements are involved: custody of the protocol's reserves, and custody of the tokens institutions hold. We do not disclose the custodians that hold the protocol's off-chain reserves. Reserve balances held with them are covered by [Accountable's independent attestations](https://tori.accountable.capital), and collateral can only move to a custody address registered on-chain through the [24-hour timelock](/security/roles). Every custodian and partner we use is licensed and regulated, has an established custody track record, meets SOC 2 or equivalent security standards, and holds assets in fully segregated accounts. Institutions can hold trUSD and strUSD with Anchorage Digital, BitGo, or Cactus Custody. All three support both tokens, which allows an institution to hold them with the custodian it already uses. This is custody of the tokens an institution owns and is separate from the custody of protocol reserves. [Institutional Custody](/resources/institutional-custody) sets out each custodian's regulated entity and what to confirm before depositing. ### Can the team access protocol assets? No single person can. Every privileged function sits behind a named role: critical operations need a 3-of-5 Safe quorum, custody transfers can only go to timelocked, pre-registered addresses, and the operational keys can each do exactly one job. The [role matrix](/security/roles) lists every role, holder, and function, and all of it is readable on-chain. *** ## Verification and transparency ### How can I verify reserves? **Three ways to verify:** Read the live, independent attestations from Accountable at [tori.accountable.capital](https://tori.accountable.capital) Verify smart contract balances directly on Etherscan ([contract addresses](/resources/contracts)) Compare total trUSD supply against attested backing ### How often are reserves verified? **Continuously.** Proof of Reserves from Accountable updates in real time, not monthly or quarterly like traditional finance. ### Where can I see the Proof of Reserves? | Source | Where | | - | - | | **Accountable** | [tori.accountable.capital](https://tori.accountable.capital) | | **Tori app** | [app.tori.finance/transparency](https://app.tori.finance/transparency) | | **Etherscan** | On-chain balances via the [contracts page](/resources/contracts) | *** ## Monitoring and incident response ### How is the protocol monitored? **Hypernative** watches the protocol around the clock. Its models flag anomalies as they happen, from unusual transactions to known attacker addresses, alert the team immediately, and keep a running risk score on the protocol. Detection and first response are automated. ### What happens during a security incident? Our incident response process: Automated monitoring is designed to identify issues immediately Rapid triage to understand severity and potential impact Immediate steps to limit damage (may include pausing operations) Updates through official channels Fix the underlying issue Analysis and preventive measures ### Can the protocol be paused? **Yes.** Mint and redeem can be shut off in a single transaction by the Gatekeeper role, which exists precisely so containment never waits on a multisig quorum. Details are in the [role matrix](/security/roles). *** ## Protecting yourself ### How can I stay safe? Only use [app.tori.finance](https://app.tori.finance). Bookmark it to avoid phishing sites. Check addresses on our [Contracts page](/resources/contracts) before interacting. Never share private keys or seed phrases with anyone. Ever. Be skeptical of DMs, airdrops, and "support" messages. ### What are common scams to watch for? | Scam type | Red flags | | - | - | | **Phishing sites** | Wrong URL, requests for seed phrase | | **Fake support** | DMs on social media claiming to be Tori | | **Airdrop scams** | "Free tokens" requiring wallet connection | | **Impersonation** | Accounts pretending to be Tori team members | ### What will the Tori team never do? The Tori team will **never**: * Ask for your seed phrase or private keys * DM you first on social media * Ask you to send tokens to "verify" your wallet * Offer exclusive deals via DM * Ask you to download software outside the official app ### What security features should I use? | Recommendation | Why | | - | - | | **Hardware wallet** | Best security for larger amounts | | **Transaction simulation** | Preview what will happen before signing | | **Address whitelisting** | Prevent accidental sends to wrong addresses | | **MFA on exchanges** | If you're bridging from centralized exchanges | *** ## Reporting issues ### How do I report a security vulnerability? **Email:** [security@tori.finance](mailto:security@tori.finance) **Please include:** * Clear description of the vulnerability * Steps to reproduce * Proof of concept (if applicable) * Potential impact assessment **Responsible disclosure:** Please don't publicly disclose vulnerabilities before they've been addressed. We commit to acknowledging reports within 24 hours. ### How do I report a scam or phishing attempt? Email [security@tori.finance](mailto:security@tori.finance) with: * Screenshots of the scam * URLs involved * Any other relevant details Reporting helps us protect the community. ### I think my wallet was compromised If you suspect unauthorized activity: 1. **Stop** - Don't make any more transactions 2. **Move assets** - Transfer remaining tokens to a new, secure wallet 3. **Report** - Create a ticket on our [Discord](https://discord.gg/torifinance) for support 4. **Document** - Save transaction hashes and screenshots *** ## Security approach ### How does Tori approach security? No single protection is trusted on its own. Audits catch issues before deployment, the bounty pays researchers to keep looking afterward, Hypernative monitors production in real time, multisigs and the timelock constrain every privileged key, and the reserve fund buffers adverse conditions. The [security overview](/security/overview) walks through each layer. ### What are the limitations? No system can guarantee perfect security. We're transparent about this: * Audits are point-in-time assessments * New attack vectors can emerge * DeFi is experimental by nature This is why the protections overlap rather than relying on any single measure. See [Risk Disclosures](/resources/risks) for complete information. *** ## More questions? For security-related inquiries: [security@tori.finance](mailto:security@tori.finance) For general support: Join our [Discord](https://discord.gg/torifinance) Every layer of the stack, in one place Dates, PDFs, and the bounty table Read these before depositing Verify every address on Etherscan This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.