> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tedprotocol.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Audits

> Continuous security verification, responsible disclosure

Security audits are essential for DeFi protocols. This page details TED Protocol's audit status and security practices.

***

### Audit Status

#### Scheduled Audits

Primary audits covering core contracts and bridge integrations are scheduled for Q1 2025. Auditor details will be announced when finalized.

#### Continuous Security

* Automated scanning runs continuously through internal tools
* Dependency monitoring via Dependabot
* Static analysis using Slither

***

### Audit Scope

#### Core Contracts

| Component     | Description                                                           |
| ------------- | --------------------------------------------------------------------- |
| DiamondProxy  | Entry point                                                           |
| FXSwapFacet   | Swap routing logic                                                    |
| DEX Adapters  | Curve Finance, Uniswap V3/V4, PancakeSwap, and DragonSwap integration |
| Bridge Facets | Circle CCTP, LayerZero OFT, Wormhole                                  |
| AdminFacet    | Governance functions                                                  |

#### Token Contracts

| Contract                  | Audit Type        |
| ------------------------- | ----------------- |
| TEDP Token (ERC-20 + OFT) | Full audit        |
| LayerZero V2 OFT Adapter  | Integration audit |

***

### Security Practices

#### Development Process

* All code changes reviewed by multiple developers
* Unit, integration, and fuzz testing required for every change
* Automated vulnerability scanning on all commits
* Extended testnet deployment before mainnet releases

#### Test Coverage Targets

| Test Type         | Target                |
| ----------------- | --------------------- |
| Unit tests        | 95%+                  |
| Integration tests | 80%+                  |
| Fuzz tests        | All critical paths    |
| Invariant tests   | Core accounting logic |

*All testing is in progress.*

#### Security Patterns

| Pattern               | Implementation               |
| --------------------- | ---------------------------- |
| Reentrancy protection | Mutex locks during execution |
| Access control        | Role-based                   |
| Pausability           | For emergency response       |

All patterns follow OpenZeppelin's well-established implementations.

***

### Bug Bounty Program

TED Protocol operates a bug bounty program to incentivize responsible disclosure.

#### Rewards

| Severity | Reward          | Examples                                               |
| -------- | --------------- | ------------------------------------------------------ |
| Critical | Up to \$100,000 | Direct loss of funds, protocol insolvency              |
| High     | Up to \$25,000  | Significant loss potential, major functionality broken |
| Medium   | Up to \$5,000   | Limited loss, moderate impact                          |
| Low      | Up to \$1,000   | Minor issues, best practice violations                 |

#### Scope

**In scope:**

* Smart contracts on all supported chains
* Bridge integrations
* TEDP token contracts
* Cross-chain messaging logic

**Out of scope:**

* Frontend/UI issues
* Third-party services
* Previously reported issues
* Social engineering attacks

#### Reporting

Submit security vulnerabilities to **[security@tedprotocol.io](mailto:security@tedprotocol.io)**.

**Include:**

* Detailed description of the vulnerability
* Steps to reproduce
* Potential impact assessment
* Suggested fix (if applicable)

**Response times:**

| Stage                  | Time              |
| ---------------------- | ----------------- |
| Initial acknowledgment | Within 24 hours   |
| Severity assessment    | Within 48 hours   |
| Resolution             | Based on severity |

***

### Third-Party Dependencies

TED Protocol relies on well-audited dependencies.

| Dependency    | Audits                    | TVL/Security |
| ------------- | ------------------------- | ------------ |
| OpenZeppelin  | Industry standard         | -            |
| Curve Finance | Trail of Bits, Quantstamp | \$2B+        |
| Uniswap V3    | Trail of Bits             | \$3B+        |
| LayerZero V2  | Zellic, Quantstamp        | \$10B+       |
| Wormhole      | Multiple audits post-2022 | \$3B+        |
| Circle CCTP   | Institutional-grade       | \$25B+       |

#### Dependency Management

* Locked versions in package files
* Automated vulnerability alerts
* Regular dependency updates
* No unaudited external calls

***

### Emergency Procedures

#### Incident Response Timeline

| Stage         | Time              | Description                 |
| ------------- | ----------------- | --------------------------- |
| Detection     | Immediately       | Automated monitoring alerts |
| Assessment    | Within 1 hour     | Security team evaluation    |
| Response      | Within 2 hours    | Pause affected components   |
| Communication | Within 4 hours    | User notification           |
| Resolution    | Based on severity | Deploy as needed            |

#### Emergency Controls

| Action            | Required Signatures | Purpose           |
| ----------------- | ------------------- | ----------------- |
| Pause             | 2-of-5              | Suspected exploit |
| Unpause           | 3-of-5              | Issue resolved    |
| Emergency upgrade | 4-of-5              | Critical fix      |

***

### Transparency

#### Open Source

All TED Protocol smart contracts are open source and verified on block explorers.

* GitHub: [github.com/tedprotocol](https://github.com/tedprotocol)
* Verification: Etherscan, Arbiscan, Basescan, etc.

#### Upgrade History

All contract upgrades are documented with:

* Upgrade rationale
* Code changes
* Audit status
* Timelock period