Security Overview

Tori runs layered security: independent audits before deployment, continuous monitoring in production, third-party attestation of reserves, and privileged keys held behind multisigs and a 24-hour timelock. No single layer is trusted to hold on its own, and each one can be checked from outside. This page describes the whole stack; the pages it links to carry the detail.

​

The security stack

​

Smart contract audits

Sherlock and Nethermind audited the protocol independently. Sherlock has historically secured over $50 billion in assets across Web3; Nethermind is a blockchain research and security firm. The audits covered the core protocol contracts, strUSD staking and unstaking, access control, and third-party integrations. Both reports are public, with dates and PDFs on the audits page, alongside a bug bounty that pays up to $1,000,000 for a critical finding.

​

Monitoring

Hypernative watches protocol activity continuously and alerts the team the moment something looks wrong: an unusual or outsized transaction, a known attacker address, an admin operation, a parameter change, an external dependency misbehaving. Its models score risk on an ongoing basis, and the first response to a detected threat is automated.

​

Proof of reserves

Accountable attests reserves and financials independently and continuously. The attestations cover total assets under management, the liability coverage ratio, and reserve fund status, and they are published at tori.accountable.capital, where anyone can read them at any time. The figures are third-party attested rather than self-reported, and they update continuously instead of on a monthly or quarterly cycle. The app mirrors the live backing data at app.tori.finance/transparency.

​

Custody

On-chain, the contracts are audited, critical operations take a multisig quorum, and anything that widens the protocol’s surface waits out a 24-hour timelock. Every function sits behind a role scoped to a single job. Off-chain reserves sit with vetted institutional custodians and partners, in segregated accounts, diversified across jurisdictions. Backing and reserves covers the asset side in detail.

​

Who can touch what

Every privileged role on the mainnet contracts is documented in the role matrix, down to the function level: what each role can do, who holds it, and how the key is custodied. The short version: no role can do more than the one job it is named for, upgrades and new custody destinations wait 24 hours in public before they can execute, and every role holder is readable on-chain.

​

Operational security

Team access requires multi-factor authentication, signing keys live in hardware security modules, each person carries the minimum access their role needs, and access rights are reviewed on a schedule. When an incident is detected, the process runs: triage and severity classification, containment, remediation, communication to users, and a post-mortem. Containment does not wait on a multisig quorum: the Gatekeeper role can shut off mint and redeem in a single transaction.

​

Reporting a vulnerability

Report security issues to [email protected]. We aim to acknowledge reports within 24 hours. Rewards, scope, and disclosure guidelines are on the audits page.

​

Next steps