Audits and Security
Security is central to a coverage product. If the protocol itself is exploited, it cannot credibly protect the positions it covers. This page collects audit and security resources for Firelight, including the foundational launch-vault audits and the new coverage-protocol audit scope.
Foundational audits (inherited from the Launch Vault)
The coverage protocol builds on the same vault and stXRP staking primitives audited for the original Firelight launch. The foundational audit scope covers:
Launch Vault (ERC-4626 contract that holds FXRP and issues stXRP)
stXRP token
Frontend application for deployments and withdrawals
These audits and their reports are the canonical security record for the underlying vault and staking infrastructure. They were originally published as part of the Phase 1 documentation; that documentation is being retired, and the audit references now live here.
New surfaces introduced for coverage
The coverage product introduces new smart-contract components, each subject to its own audit scope:
Cover Registry
Parameter publication, access control, update authorization
Cover Agent
Quoting logic, premium pull via approval, coverage-token issuance
Cover Token (ERC-7621)
Token implementation, state transitions, metadata handling
Claims Registry
Incident recording, auto-inclusion logic, vote aggregation, slash-instruction generation
First-Loss Buffer
Stablecoin reserve management, draw-down logic
Vault slashing hooks
Slash-instruction execution, pro-rata accounting, concurrency guards
Fee Distributor
Premium split, reward streaming, claim mechanism
Audits for these components are conducted by recognized firms before the feature-complete launch and before any material upgrade.
Audit publication
Completed audit reports for both the foundational launch-vault contracts and the coverage components are published in the Firelight audit repository, alongside bounty program details and change logs for post-audit modifications.
Bug bounty program
Firelight maintains an active bug bounty program covering deployed coverage contracts, integrations with external custody and liquidation venues (where Firelight code is involved), and off-chain services that write to on-chain state under authorized roles. Reports should be submitted through the official bounty channel rather than disclosed publicly.
Monitoring integrations
The protocol integrates with third-party monitoring infrastructure for real-time incident detection. Covered protocols are required to participate in this monitoring as a condition of coverage. Alerts feed the Claims Registry and the Risk Consortium when an incident is detected.
External dependencies
Firelight's security posture depends on several external components: the host chain, oracle infrastructure, custody providers, and liquidation counterparties. Due diligence on these is part of the Foundation's ongoing responsibility, and incidents at any of these layers are reflected in the monitored risk view for affected markets.
Incident response
If an incident affects the coverage protocol itself (rather than a covered protocol), active operations may be paused to contain the issue, the Foundation coordinates with service providers and auditors to assess scope, affected participants are notified through official channels, and a post-mortem is published once remediation is complete. Pausing is reserved for genuine emergencies, not routine operations.
Where to read next
Links & Contact for the bug bounty channel and full cover terms.
Last updated