Audit Status
Scheduled Audits
Primary audits covering core contracts and bridge integrations are scheduled for Q1 2025. Auditor details will be announced when finalized.Continuous Security
- Automated scanning runs continuously through internal tools
- Dependency monitoring via Dependabot
- Static analysis using Slither
Audit Scope
Core Contracts
| Component | Description |
|---|---|
| DiamondProxy | Entry point |
| FXSwapFacet | Swap routing logic |
| DEX Adapters | Curve Finance, Uniswap V3/V4, PancakeSwap, and DragonSwap integration |
| Bridge Facets | Circle CCTP, LayerZero OFT, Wormhole |
| AdminFacet | Governance functions |
Token Contracts
| Contract | Audit Type |
|---|---|
| TEDP Token (ERC-20 + OFT) | Full audit |
| LayerZero V2 OFT Adapter | Integration audit |
Security Practices
Development Process
- All code changes reviewed by multiple developers
- Unit, integration, and fuzz testing required for every change
- Automated vulnerability scanning on all commits
- Extended testnet deployment before mainnet releases
Test Coverage Targets
| Test Type | Target |
|---|---|
| Unit tests | 95%+ |
| Integration tests | 80%+ |
| Fuzz tests | All critical paths |
| Invariant tests | Core accounting logic |
Security Patterns
| Pattern | Implementation |
|---|---|
| Reentrancy protection | Mutex locks during execution |
| Access control | Role-based |
| Pausability | For emergency response |
Bug Bounty Program
TED Protocol operates a bug bounty program to incentivize responsible disclosure.Rewards
| Severity | Reward | Examples |
|---|---|---|
| Critical | Up to $100,000 | Direct loss of funds, protocol insolvency |
| High | Up to $25,000 | Significant loss potential, major functionality broken |
| Medium | Up to $5,000 | Limited loss, moderate impact |
| Low | Up to $1,000 | Minor issues, best practice violations |
Scope
In scope:- Smart contracts on all supported chains
- Bridge integrations
- TEDP token contracts
- Cross-chain messaging logic
- Frontend/UI issues
- Third-party services
- Previously reported issues
- Social engineering attacks
Reporting
Submit security vulnerabilities to security@tedprotocol.io. Include:- Detailed description of the vulnerability
- Steps to reproduce
- Potential impact assessment
- Suggested fix (if applicable)
| Stage | Time |
|---|---|
| Initial acknowledgment | Within 24 hours |
| Severity assessment | Within 48 hours |
| Resolution | Based on severity |
Third-Party Dependencies
TED Protocol relies on well-audited dependencies.| Dependency | Audits | TVL/Security |
|---|---|---|
| OpenZeppelin | Industry standard | - |
| Curve Finance | Trail of Bits, Quantstamp | $2B+ |
| Uniswap V3 | Trail of Bits | $3B+ |
| LayerZero V2 | Zellic, Quantstamp | $10B+ |
| Wormhole | Multiple audits post-2022 | $3B+ |
| Circle CCTP | Institutional-grade | $25B+ |
Dependency Management
- Locked versions in package files
- Automated vulnerability alerts
- Regular dependency updates
- No unaudited external calls
Emergency Procedures
Incident Response Timeline
| Stage | Time | Description |
|---|---|---|
| Detection | Immediately | Automated monitoring alerts |
| Assessment | Within 1 hour | Security team evaluation |
| Response | Within 2 hours | Pause affected components |
| Communication | Within 4 hours | User notification |
| Resolution | Based on severity | Deploy as needed |
Emergency Controls
| Action | Required Signatures | Purpose |
|---|---|---|
| Pause | 2-of-5 | Suspected exploit |
| Unpause | 3-of-5 | Issue resolved |
| Emergency upgrade | 4-of-5 | Critical fix |
Transparency
Open Source
All TED Protocol smart contracts are open source and verified on block explorers.- GitHub: github.com/tedprotocol
- Verification: Etherscan, Arbiscan, Basescan, etc.
Upgrade History
All contract upgrades are documented with:- Upgrade rationale
- Code changes
- Audit status
- Timelock period