# Security

Smart contract security is a top priority for those working on Aura Finance. All reasonable precautions must be taken to ensure the protocol is safe to use. Below is a list of some of the things we believe make smart contract systems secure.

## Chainalysis's Proactive Incident Response

Aura has partnered up with [@chainalysis](https://twitter.com/chainalysis) to adopt an[ Incident Response Plan ](https://vote.aura.finance/#/proposal/0x2fbb1422b9efea30fc91b714645ef9591a8291c896e5f0e70efdf43d9a322f05)for the protocol. The IRP adds an extra layer of security on top of well-developed code and audits, Aura will be able to deter hackers and have an asset recovery plan in potential events.

### Audits

#### Audit 1 - Peckshield (4-18th Apr 2022)

{% file src="<https://3372224363-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr4kLuYPt1EhIEVbkxHD8%2Fuploads%2FfdfqRL0AQnO06jcoxF2o%2FPeckShield-Audit-Report-AuraFinance-v1.0.pdf?alt=media&token=689db44f-f38d-45a3-9fb2-450863b46f6c>" %}

#### Audit 2 - Code4rena (11-25th May 2022)

A $150k, 2 week long audit competition ran on <https://code4rena.com/> allowed anyone with knowledge of the system, or just general bug hunters, a chance to come and contribute to the security of the Aura system before launch.

{% file src="<https://3372224363-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr4kLuYPt1EhIEVbkxHD8%2Fuploads%2FDuQMD5ULdRtqravKUwxQ%2FCode4rena-Audit-Report-AuraFinance-v1.0.pdf?alt=media&token=430daeb5-5760-4df5-bba6-636abb0f6988>" %}

#### Audit 3 - Halborn (12th May - 23rd June 2022)

A 6 week audit has been performed by Halborn Security (<https://twitter.com/HalbornSecurity>).

{% file src="<https://3372224363-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr4kLuYPt1EhIEVbkxHD8%2Fuploads%2FMZAsINwNDzYc495yC60R%2FHalborn-Audit-Report-AuraFinance-v1.0.pdf?alt=media&token=04515c2e-c52d-4350-ae64-c1f3053add10>" %}

#### Audit 4 - Halborn (6th March - 20th March 2023)

A 2 week audit has been performed by Halborn Security to audit AuraBal Compounder contracts (<https://twitter.com/HalbornSecurity>).

{% file src="<https://3372224363-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr4kLuYPt1EhIEVbkxHD8%2Fuploads%2FdpPicVneOrKaZPH8PMdj%2Fhalborn_aurabal_vault_audit_report.pdf?alt=media&token=c55b6e3f-98be-4381-ac84-d0756bdac87a>" %}

#### Audit 5 - Halborn (09th May - 06th June 2023)

A 4 week audit has been performed by Halborn Security to audit Sidechain contracts and  Convex Platform lite version contracts

&#x20;(<https://twitter.com/HalbornSecurity>).

{% file src="<https://3372224363-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr4kLuYPt1EhIEVbkxHD8%2Fuploads%2FY8Gh2vYEHJhByg1ubpgI%2Fhalborn_sidechain_audit_report.pdf?alt=media&token=208c6c1e-0363-4b79-b0a9-31afbd91aa3d>" %}

#### Audit 6 - Zellic (28th May - 06th June 2023)

A 8 days audit has been performed by Zellic Inc to audit Sidechain contracts and  Convex Platform lite version contracts

&#x20;(<https://twitter.com/zellic_io>).

{% file src="<https://3372224363-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr4kLuYPt1EhIEVbkxHD8%2Fuploads%2FSpjxmJq2qTcJ8kMKWUnl%2Fzellic_sidechain_audit_report.pdf?alt=media&token=853fc8d5-b040-465d-af1d-1c013559843a>" %}

### Bug bounties

External bug bounties are essential for projects. Aura has placed a $1m critical bug bounty payout on Immunefi.

{% embed url="<https://immunefi.com/bounty/aurafinance>" %}

###

### Internal processes

#### Codebase

Some practices employed on Aura Finance smart contract repositories:

* protected `master` branch with mandatory peer reviews and passing CI (including linting, compiling, and testing)
* \>98% code coverage (using coveralls) and comprehensive integration tests
* Strict linting rules
* Code commented using the Natspec standard

#### Fork testing

Fork testing is helps simulate contract deployments and functionality in a live environment, accounting for external dependencies. Aura comprehensively tests deployments using fork tests.

#### Internal auditing

Developers know their code best, and dedicated time has been taken to manually review all code in the system.

### Contact

If you have any feedback or concerns, reach out to `security@aura.finance` or to an admin on Discord