> ## Documentation Index > Fetch the complete documentation index at: https://mintlify.com/reserve-protocol/reserve-index-dtf/llms.txt > Use this file to discover all available pages before exploring further. # Security Audits > Security audits and reviews of Reserve Folio protocol ## Overview Reserve Folio has undergone multiple comprehensive security audits by leading security firms. This page provides information about completed audits and their findings. All critical and high-severity findings from audits have been addressed before deployment. ## Completed Audits ### Trust Security - v1.0.0 **Auditor:** Trust Security **Version:** 1.0.0 (Initial Release) **Focus:** Non-repeatable pairwise auctions **Report:** Available in the [audits directory](https://github.com/reserve-protocol/reserve-index-dtf/tree/main/audits/trust-security) ### Cantina - Competition Audit **Auditor:** Cantina (Competition Format) **Version:** Multiple versions reviewed **Format:** Public competition with multiple security researchers **Report:** Available in the [audits directory](https://github.com/reserve-protocol/reserve-index-dtf/tree/main/audits/cantina) Competition audits leverage the "wisdom of the crowd" with multiple independent security researchers competing to find vulnerabilities. ### Trail of Bits - v2.0.0 **Auditor:** Trail of Bits **Version:** 2.0.0 (Repeatable Auctions) **Focus:** Repeatable pairwise auctions, dust limits, minimum mint enforcement **Report:** Available in the [audits directory](https://github.com/reserve-protocol/reserve-index-dtf/tree/main/audits/trail-of-bits) This audit covered significant new features including repeatable auctions and dust limit mechanisms. ### Trail of Bits - v4.0.0 **Auditor:** Trail of Bits **Version:** 4.0.0 (Basket Auctions) **Focus:** Rebalance targets, trusted fillers integration, auction overhaul **Report:** Available in the [audits directory](https://github.com/reserve-protocol/reserve-index-dtf/tree/main/audits/trail-of-bits) Version 4.0.0 represented a major architecture change from pairwise to basket-level auctions. ### Pashov Audit Group - v4.0.0+ **Auditor:** Pashov Audit Group **Version:** 4.0.0 and subsequent updates **Focus:** Comprehensive security review **Report:** Available in the [audits directory](https://github.com/reserve-protocol/reserve-index-dtf/tree/main/audits/pashov) ## Audit Timeline **Trust Security** - v1.0.0 audit completed Initial release audit covering core functionality **Cantina Competition** - Public audit competition Multiple researchers reviewed the protocol **Trail of Bits** - v2.0.0 audit completed Repeatable auctions and new features **Trail of Bits & Pashov** - v4.0.0 audits completed Major architecture changes reviewed ## Key Security Features ### Reentrancy Protection All mutator functions use `nonReentrant` modifiers to prevent reentrancy attacks. Async actions are closed as a pre-hook before state changes. While the Folio itself is protected, consuming protocols should check: ```solidity theme={null} (bool rebalanceActive, bool asyncActionActive) = folio.stateChangeActive(); require(!rebalanceActive && !asyncActionActive); ``` ### Access Control The protocol uses OpenZeppelin's AccessControl for fine-grained permissions: * `DEFAULT_ADMIN_ROLE`: Full administrative control * `REBALANCE_MANAGER`: Rebalancing operations * `AUCTION_LAUNCHER`: Auction initiation and management Each role has specific, limited capabilities. ### Price Protection Maximum price range per auction: 100x (4 orders of magnitude) Prevents extreme price manipulation. `AUCTION_LAUNCHER` can only operate within bounds set by `REBALANCE_MANAGER`. Limits potential damage from compromised launcher. ### Overflow Protection All arithmetic uses: * Solidity 0.8+ built-in overflow checks * Carefully designed ranges to prevent overflow * D18 and D27 precision with validated limits ## Security Considerations ### Trusted Roles **Semi-Trusted AUCTION\_LAUNCHER** The `AUCTION_LAUNCHER` role is semi-trusted and can: * Open auctions within governance-approved ranges * Potentially cause value leakage if malicious (depending on `PriceControl` setting) * Block rebalancing by staying offline **Mitigation:** Permissionless auction opening after restricted period expires. ### Price Control Modes **Risk Level:** Low `AUCTION_LAUNCHER` cannot modify prices. Must use governance-set ranges. **Best for:** Most Folios, especially those with public/untrusted launchers. **Risk Level:** Medium `AUCTION_LAUNCHER` can select subset of price range. **Risks:** * Can begin auctions at suboptimal prices * Value leakage to MEV searchers possible * Cannot guarantee they benefit from leaked value **Best for:** Folios with trusted launchers needing price precision. **Risk Level:** High `AUCTION_LAUNCHER` can perform atomic swaps at fixed prices. **Risks:** * Full control over clearing price * Can internalize MEV * Value leakage with guaranteed beneficiary (launcher) **Best for:** Highly trusted, sophisticated launchers with strong accountability. ### Token Risks Governance must carefully vet tokens before inclusion. See [Token Compatibility](/resources/token-compatibility) for details. Key risks: * Pausable tokens can freeze the Folio * Fee-on-transfer breaks accounting * Rebasing tokens can cause accounting drift ### MEV Exposure Dutch auctions are inherently exposed to MEV. Mitigation strategies: 1. **Tight Price Ranges:** Reduce arbitrage opportunities 2. **Trusted Fillers:** Use CoW Swap for MEV protection 3. **Active Launcher:** Responsive `AUCTION_LAUNCHER` improves execution 4. **Permissionless Fallback:** Ensures liveness even if launcher is offline ## Vulnerability Disclosure If you discover a security vulnerability: 1. **DO NOT** create a public GitHub issue 2. See the [Bug Bounty Program](/resources/bug-bounty) for responsible disclosure 3. Contact the team through secure channels Reserve Protocol values the security community's contributions and rewards responsible disclosure through its bug bounty program. ## Audit Reports Access All audit reports are available in the source repository: ```bash theme={null} audits/ ├── cantina/ │ └── report-competition-reserve-jan2025.pdf ├── pashov/ │ └── reserve-security-review_2025-06-02.pdf ├── trail-of-bits/ │ ├── 2025-04-reserve-folio-solidity-2.0.0.pdf │ └── 2025-06-reserve-folio-solidity-4.0.0.pdf └── trust-security/ └── v1-audit-dec-2024.pdf ``` ## Continuous Security Major releases undergo comprehensive security audits Ongoing incentives for security researchers Open-source code allows continuous community scrutiny Multi-signature and timelock governance reduces risk ## Related Documentation Report vulnerabilities and earn rewards Security considerations for different token types Understanding access control and permissions Governance security model