Reference
Security and risks
What has been verified, what hasn't, what the admin can and cannot do, and the risks of using this unaudited protocol.
What has been done
- Test suite: Solidity tests pass, including live ATS fork checks that run issuance, deposits, splits, trades, revocation, coupons, and maturity settlement against the real ATS factory. The SDK and app test suites also pass.
- Property and invariant tests: fuzzed and invariant runs exercise random splits, transfers, claims, recombines, and redemptions under changing rates, checking that the escrow still covers what it owes.
- Live testnet checks: the current market has confirmed deployment, funding, investment, trading and liquidity receipts, including an embedded-wallet investment. Coupon, revocation and maturity records from earlier markets are historical evidence. See
contracts/deployments/evidence/. - Reproducible builds: dependencies are pinned, and the ATS deployment records its compiler settings and build inputs so the deployed bytecode can be compared against source (see Deployed contracts).
- Fixed-point arithmetic: Solidity has no floating-point type, so the curve is implemented entirely in WAD fixed-point integer series. The pricing arithmetic cannot silently regress to floating point.
What the admin can and cannot do
Admin authority is enforced independently by each contract:
- SY vault: its strategy is bound immutably at initialization, and the admin may only set a deposit cap. There is no rate setter, so the admin cannot touch the exchange rate.
- AMM, tokenizer, and orderbook: their configured admins may update their respective bounded fees. Every fee change emits an on-chain event. The app only enables a control when the connected wallet matches that contract’s stored admin.
- Cannot: upgrade contracts, move or freeze holder funds, manually set the exchange rate, mint holder tokens, or pause redemptions. Fee authority cannot bypass the on-chain ceilings.
The production rate path has no human in it: the SY rate is derived from the bond strategy’s holdings on every read, and no contract exposes a setter that could configure it any other way.
Risk register
| Risk | Posture |
|---|---|
| Contract defect (unaudited code) | The dominant risk. Immutable contracts make any defect permanent. Testing and internal audits reduce it; nothing eliminates it. Size positions accordingly. |
| Underlying failure (bond / issuer) | SY is a bond position, so a bond default or loss is an SY loss. The damage is contained to this one vault, and it is priced rather than blocked: PT redemptions cap at each holder’s fair share, and PT is paid before YT. |
| Price-feed manipulation | There is no external price feed to manipulate. The rate is derived from the bond strategy directly, and outside integrators get a 30-minute average with an explicit warming-up flag. |
| Thin liquidity | Trades in the current shallow pool move prices sharply. Every swap carries a minimum-received floor, so a stale quote cancels instead of filling badly. |
| Falling interest rates | If the bond’s effective rate falls, YT earns less than its price implied. That is the instrument working as designed, not failing: YT is the leveraged side. |
| Network / RPC availability | Reads go through Hedera JSON-RPC with failover across endpoints. Funds and state live on-chain; an RPC outage delays the app but cannot move or lose balances. Contract storage does not expire, so there is no rent or TTL to lapse. |
| Interest at the maturity boundary | The freeze pins the last rate recorded at or before maturity. Any small unrecorded tail goes predictably to PT (the senior claim), never to whoever transacts fastest. |
Reporting a vulnerability
Report security findings privately through GitHub’s security advisory flow in the project repository, not as a public issue.