> ## Documentation Index > Fetch the complete documentation index at: https://docs.tori.finance/llms.txt > Use this file to discover all available pages before exploring further. # Audits > Smart contract security audits and reports Every Tori contract went through independent review before deployment. Both reports are public: | Audit | Scope | Date | Report | | - | - | - | - | | Nethermind security review | Full protocol | March 24 - 26, 2026 | [PDF](https://github.com/NethermindEth/PublicAuditReports/blob/main/NM_0854_Tori.pdf) | | Sherlock collaborative audit | Full protocol | January 15 - 22, 2026 | [PDF](https://github.com/sherlock-protocol/sherlock-reports/blob/main/audits/2026.02.10%20-%20Final%20-%20Tori%20Finance%20Collaborative%20Audit%20Report%201770734349.pdf) | Every finding across both audits was either fixed in code or formally acknowledged with a documented rationale. ## Who audited [Sherlock](https://www.sherlock.xyz/) is a smart contract security platform that has historically secured over **\$50 billion** in assets across Web3 protocols. [Nethermind](https://www.nethermind.io/) is a blockchain research and engineering firm whose security practice pairs manual analysis with automated tooling and rates risk on OWASP principles. The audits covered the core protocol contracts, the trUSD token, strUSD staking and unstaking, access control, and the oracle integration. ## Bug bounty The bounty runs continuously and pays by severity: | Severity | Reward | | - | - | | Critical | Up to \$1,000,000 | | High | \$10,000 - \$50,000 | | Medium | \$1,000 - \$10,000 | | Low | Up to \$1,000 | In scope: all deployed smart contracts, integration vulnerabilities, economic attack vectors, and access control issues. Out of scope: already-known issues, third-party protocols, frontend and UI issues (a separate program), and theoretical attacks without a proof of concept. ## Reporting a vulnerability Email [security@tori.finance](mailto:security@tori.finance). A useful report has a clear description of the issue, steps to reproduce, a proof of concept where applicable, and your read on the impact. A suggested fix is welcome but not required. What happens next: | Phase | Target timeline | | - | - | | Acknowledgment | Within 24 hours | | Initial assessment | Within 72 hours | | Remediation plan | Within 1 week | | Fix deployment | Varies by severity | | Public disclosure | After the fix is live | Please do not disclose a vulnerability publicly before it has been addressed, exploit it beyond what is needed to demonstrate the issue, or access other users' data. We take no legal action against good-faith researchers, and we credit reporters after fixes ship if they want the credit. ## After the audit An audit is a snapshot, so review does not stop at deployment. Major updates trigger a re-audit of the changed components, new features are audited before they ship, and Hypernative [monitors the deployed contracts](/security/overview) in production. Issues that surface get patched promptly and communicated openly. ## Limitations **Important to understand:** * Audits reduce risk but don't eliminate it * New vulnerabilities may be discovered after audits * Economic attacks may not be caught by code audits * Third-party dependencies carry their own risks Please review our complete [Risk Disclosures](/resources/risks). ## Verify it yourself The audit PDFs above are hosted by the auditors, not by us. Contract source is verified on Etherscan, with every address listed on the [contracts page](/resources/contracts). The bounty is live; write to [security@tori.finance](mailto:security@tori.finance). ## Next steps The full stack: audits, monitoring, attestation, custody Who holds which key, and what the timelock gates Verified addresses on mainnet The complete risk disclosures This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.