> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tori.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Audits

> Smart contract security audits and reports

## Overview

Security audits are a critical component of Tori's security infrastructure. All smart contracts undergo rigorous review by leading security firms before deployment.

## Audit Partners

### Sherlock

<Card title="Sherlock" icon="shield-check" href="https://www.sherlock.xyz/">
  Leading smart contract security platform protecting over **\$50 billion** in assets across Web3 protocols.
</Card>

**Why Sherlock:**

* Thorough audit methodology
* Team of experienced security researchers
* Proven track record with major DeFi protocols

### Nethermind

<Card title="Nethermind" icon="shield-check" href="https://www.nethermind.io/">
  Leading blockchain research and software engineering firm providing security audits, infrastructure, and tooling across the Web3 ecosystem.
</Card>

**Why Nethermind:**

* Deep expertise in EVM smart contract security
* Thorough manual analysis combined with automated tooling
* Risk rating methodology based on OWASP principles
* Proven track record with major DeFi and infrastructure protocols

## Audit Scope

Our audits cover all critical protocol components:

| Component              | Description                              | Status  |
| ---------------------- | ---------------------------------------- | ------- |
| **Core Protocol**      | Main protocol contracts and logic        | Audited |
| **trUSD Token**        | ERC-20 token contract                    | Audited |
| **strUSD Staking**     | Staking and unstaking contracts          | Audited |
| **Access Control**     | Administrative functions and permissions | Audited |
| **Oracle Integration** | Price feed integrations                  | Audited |

## Audit Reports

### Available Reports

| Audit                            | Scope         | Date                  | Report                                                                                                                                                                              |
| -------------------------------- | ------------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Nethermind Security Review**   | Full protocol | March 24 - 26, 2026   | [View Report](https://github.com/NethermindEth/PublicAuditReports/blob/main/NM_0854_Tori.pdf)                                                                                       |
| **Sherlock Collaborative Audit** | Full protocol | January 15 - 22, 2026 | [View Report](https://github.com/sherlock-protocol/sherlock-reports/blob/main/audits/2026.02.10%20-%20Final%20-%20Tori%20Finance%20Collaborative%20Audit%20Report%201770734349.pdf) |

### Findings Summary

All issues across both audits have been addressed, every finding was either fixed in code or formally acknowledged with a documented rationale.

## Bug Bounty Program

In addition to formal audits, we maintain an active bug bounty program.

### How It Works

<Steps>
  <Step title="Discover">
    Security researchers identify potential vulnerabilities in our smart contracts.
  </Step>

  <Step title="Report">
    Submit findings through our responsible disclosure process.
  </Step>

  <Step title="Verify">
    Our team verifies the validity and severity of the finding.
  </Step>

  <Step title="Reward">
    Valid findings receive rewards based on severity.
  </Step>
</Steps>

### Severity Levels

| Severity     | Description                         | Typical Reward |
| ------------ | ----------------------------------- | -------------- |
| **Critical** | Direct loss of protocol assets      | Highest        |
| **High**     | Significant impact on protocol      | High           |
| **Medium**   | Limited impact, specific conditions | Medium         |
| **Low**      | Minor issues, best practices        | Lower          |

### Scope

The bug bounty covers:

* All deployed smart contracts
* Integration vulnerabilities
* Economic attack vectors
* Access control issues

**Out of scope:**

* Already known issues
* Third-party protocols
* Frontend/UI issues (separate program)
* Theoretical attacks without PoC

## Reporting Vulnerabilities

**Email:** [security@tori.finance](mailto:security@tori.finance)

### What to Include

A good vulnerability report includes:

* Clear description of the issue
* Step-by-step reproduction instructions
* Proof of concept (if applicable)
* Potential impact assessment
* Suggested remediation (optional)

### Response Timeline

| Phase                  | Timeline           |
| ---------------------- | ------------------ |
| **Acknowledgment**     | Within 24 hours    |
| **Initial Assessment** | Within 72 hours    |
| **Remediation Plan**   | Within 1 week      |
| **Fix Deployment**     | Varies by severity |
| **Public Disclosure**  | After fix is live  |

## Ongoing Security

Security is not a one-time event. We maintain continuous security through:

### Re-Audits

| Trigger             | Action                              |
| ------------------- | ----------------------------------- |
| **Major Updates**   | Full re-audit of changed components |
| **New Features**    | Audit of new functionality          |
| **Periodic Review** | Regular security assessments        |

### Continuous Monitoring

Hypernative provides 24/7 monitoring of all protocol activity:

* Anomaly detection
* Threat identification
* Automated alerting
* Risk scoring

### Security Updates

We commit to:

* Prompt patching of identified issues
* Transparent communication about security events
* Regular security status updates

## Limitations

<Warning>
  **Important to understand:**

  * Audits reduce risk but don't eliminate it
  * New vulnerabilities may be discovered after audits
  * Economic attacks may not be caught by code audits
  * Third-party dependencies carry their own risks

  Please review our complete [Risk Disclosures](/resources/risks).
</Warning>

## Verification

You can verify our security measures:

| What to Check         | How to Verify                                                          |
| --------------------- | ---------------------------------------------------------------------- |
| **Audit Reports**     | Download and review full reports                                       |
| **Contract Code**     | Verified on block explorers                                            |
| **Bug Bounty Status** | Active (contact [security@tori.finance](mailto:security@tori.finance)) |
| **Monitoring Status** | Hypernative dashboard                                                  |

## Next Steps

<CardGroup cols={2}>
  <Card title="Security Overview" icon="shield" href="/security/overview">
    Our comprehensive security approach
  </Card>

  <Card title="Contracts" icon="file-code" href="/resources/contracts">
    View verified contract addresses
  </Card>

  <Card title="Backing" icon="vault" href="/solution/backing">
    How trUSD is backed
  </Card>

  <Card title="Risks" icon="triangle-exclamation" href="/resources/risks">
    Understand the risks
  </Card>
</CardGroup>