> For the complete documentation index, see [llms.txt](https://clio-defi.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clio-defi.gitbook.io/docs/security-and-audits.md). # Security and audits ### Review Status Clio DeFi has not yet completed a third-party smart-contract audit. An independent security review process is being planned for Router, Vault, and Lend execution pathways. Review scope, firm selection, and report publication timeline will be disclosed before completion claims are made. Planned review scope: * Router contract (single-hop and multi-hop dispatch, slippage handling) * Vault contract family (deposit, lock, withdraw, auto-compound) * Lend module contract pathways as Phase III scope activates * Treasury multi-sig configuration The planned external review scope excludes the front-end and indexer, which are not in the custody trust path. Those are reviewed internally through code review and release controls. ### Security Architecture Three principles shape the contracts: 1. **Single entry point for swaps.** The Router is the only contract that holds user funds during a swap, and only for the duration of a single transaction. There is no swap state that persists between blocks. 2. **Receipts, not custody, for staking.** Vault deposits return a non-transferable receipt token. Yield accrues to the receipt holder. Principal is always returnable to the original depositor. 3. **Time-locked treasury moves.** Multi-sig transactions over 50,000 USDT-equivalent require a 24-hour timelock. This window is non-negotiable and is designed for community observation, not just multi-sig signer review. ### Bug Bounty A bug bounty program will open at the start of Phase III, hosted on Immunefi. Rewards will be tiered by severity per the standard Immunefi classification, with critical-severity reports eligible for the highest tier. ### Operational Security * All deployer keys are held in Ledger hardware wallets, sharded across signers * The deployment pipeline requires two reviewers and one CI verification before any contract is deployed to mainnet * Front-end deployments are pinned to specific commit hashes in Vercel and rolled forward only after manual sign-off ### What Users Should Verify Before Use Before transacting, users are encouraged to: * Confirm they are on `cliodefi.xyz` (the only official domain) * Confirm the connected chain reads "BNB Smart Chain" or "BSC" * Inspect the contract address on BscScan against the addresses published on this page (after launch) * Review the published independent security report (after publication) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://clio-defi.gitbook.io/docs/security-and-audits.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.