Security is the
only launch criterion.
We delayed the testnet from August 9 to August 30 because four critical vulnerabilities were found in the final pre-launch review. We could have shipped anyway and hoped nobody noticed. We chose not to. Here is exactly how XELIS Vault protects your funds, and how you can help us find anything we missed.
Defense in depth
Four independent layers. All four must fail for funds to be lost.
2-Step Emergency Withdraw
Every fund-holding contract implements a 2-step emergency withdraw with a 17,280 block delay (~24h at 5s blocks). This means even if an admin key were compromised, an attacker cannot drain funds instantly — the community has a full day to react, pause the contract via the guardian multisig, and migrate funds safely.
Reentrancy Guards (RG_STATUS_KEY)
Every contract that touches funds implements the RG_STATUS_KEY pattern from ReentrancyGuard.slx. The guard sets a status flag at function entry and verifies it on exit, blocking any reentrant call before the original completes. This is the same defense used by OpenZeppelin, adapted to Silex semantics.
Guardian Multisig (3-of-5)
A 3-of-5 guardian multisig can pause any contract in case of emergency. Every governance action passes through a 48-hour Timelock, so the community has time to inspect and exit positions before a malicious proposal can execute. Guardians are doxxed community members elected by VLT holders.
Circuit Breakers
The StakedOracle automatically pauses price submissions if the new price deviates more than 5% from the previous one — a single bad data point cannot cascade. The VaultEngine pauses new borrows if the protocol-wide health factor drops below 1.1, preventing a death spiral during market crashes.
Audit history
Every audit finding is public. Every fix is verified on-chain.
v5.0 Internal Audit
v5.1 Pre-launch Review
Issues addressed: VaultEngine liquidation queue, PSM rounding error, VaultSwapV2 TWAP manipulation, Miner heartbeat reorg handling
v11.3 External IA Audit
Issues addressed: 9 bugs found by external IA audit: 5 critical (wrong oracle entry IDs in PSM/VaultSwap/LendingMarket/SyndicatePool/VaultEngine), 2 high (circuit breaker never checked, FlashLoan callback whitelist unused), 1 medium (Ciphertext code may not compile). All fixed + 11 entry wrappers added + chunk ID validator rewritten (73/73 real OK).
v10.2 Brainstorming Review
Issues addressed: 13 new Phase 5+ contracts reviewed for Silex API compliance, anti-abuse mechanisms, and privacy preservation. No critical or high findings — contracts gated behind governance vote before deployment.
External Audit
Four critical vulnerabilities, found and fixed in the final week.
- →VaultEngine liquidation queue: Front-runnable by mempool watchers, allowing attackers to steal collateral before legitimate liquidators could act. Fixed by committing to a sealed-bid auction.
- →PSM rounding error: A truncation bug in the fee calculation allowed minting tiny amounts of xUSD without depositing the corresponding XEL. Fixed with proper decimal scaling.
- →VaultSwapV2 TWAP manipulation: Sandwich attacks could move the TWAP during low-liquidity periods. Fixed with a minimum-liquidity check and a longer window.
- →Miner heartbeat reorg handling: Chain reorganizations could slash miners incorrectly. Fixed by requiring 6 confirmations before slashing.
Every fix has been re-deployed to the testnet contracts and re-verified. The new target is August 30, 2026 at 14:00 UTC.
Bug bounty program
Up to 50,000 VLT for critical findings. Total allocation: 100,000 VLT (1% of fixed supply), split 50% critical / 30% high / 15% medium / 5% low, distributed over 2 years on Immunefi. Responsible disclosure only — public disclosure of an unpatched vulnerability voids the bounty.
Remote code execution, theft of funds, complete protocol compromise, oracle manipulation that allows minting unbacked xUSD.
Partial theft of funds, governance attack vectors, bypass of the 2-step emergency withdraw, breaking of the reentrancy guard.
Denial of service, information disclosure across encrypted balances, minor fund loss through edge-case rounding.
Gas optimization issues, UX edge cases, documentation errors, minor logic bugs with no fund impact.
Report a vulnerability
Email xelisvault@protonmail.org with a detailed writeup and proof of concept. We acknowledge every report within 48 hours. PGP-encrypted reports are preferred.