Heartwood
[ SECURITY ]
Audits, contest and bounty
Immutable core contracts, a minimal governance surface and layered independent review. Summaries below; full PDF reports ship with the public repository at mainnet.
Audit · Core lending markets
Scope: vault accounting, interest accrual, collateral management, health factor math. Two independent firms, Q1 2026, four engineer-weeks each.
| Severity | Found | Status |
|---|---|---|
| Critical | 0 | n/a |
| High | 0 | n/a |
| Medium | 2 | Resolved and re-reviewed |
| Low / informational | 6 | Resolved |
Both medium findings concerned rounding direction in share-price math under extreme utilization; fixes were verified with fuzz suites of 10M+ runs.
Audit · Oracle and NAV module
Scope: dual-feed aggregation, NAV attestation verification, deviation halts, market-hours bands. Q1 2026.
| Severity | Found | Status |
|---|---|---|
| Critical | 0 | n/a |
| High | 0 | n/a |
| Medium | 1 | Resolved and re-reviewed |
| Low / informational | 4 | Resolved |
The medium finding covered attestation replay within a stale window; signatures now bind block height and market id.
Public contest · Liquidation engine
A four-week open competition covering the Dutch-auction engine and keeper incentives. 312 researchers participated.
- 3 medium findings confirmed, all fixed before code freeze.
- No path to lender loss was demonstrated.
- Invariants (auction monotonicity, health restoration, penalty bounds) were formally verified after fixes.
Bug bounty
A standing program, administered via Immunefi, live from mainnet day one. Payouts in stablecoins, scaled by severity and funds at risk:
| Severity | Example | Max reward |
|---|---|---|
| Critical | Direct theft or freezing of user funds | $2,000,000 |
| High | Theft of unclaimed yield, oracle manipulation | $250,000 |
| Medium | Griefing with material cost, broken invariants | $50,000 |
| Low | Best-practice deviations with impact | $5,000 |
Responsible disclosure: security@heartwood.finance. Please do not test against production markets.
Operational security
- Immutable core. Market logic is non-upgradeable; new features ship as new markets.
- 48-hour timelock. Every parameter change queues publicly for 48 hours before execution.
- Pause-only guardian. Emergency powers can pause new activity; they can never move user funds.
- Zero admin keys to funds. No role in the system can transfer user collateral or deposits.
- Formal verification. Interest accrual and health-factor invariants are machine-checked against the specification.