Audits and Security

Security is central to a coverage product. If the protocol itself is exploited, it cannot credibly protect the positions it covers. This page collects audit and security resources for Firelight.

Phase 1: Launch Vault Audits

• OpenZeppelin - smart contract audit

• Coinspect - frontend audit

• Immunefi - audit competition

Phase 2: Feature-Complete Launch

• 0xMacro - smart contract audit

• Immunefi - audit competition

Bug bounty program

Firelight maintains an active bug bounty program covering deployed coverage contracts, integrations with external custody and liquidation venues (where Firelight code is involved), and off-chain services that write to on-chain state under authorized roles. Reports should be submitted through the official bounty channel rather than disclosed publicly.

Monitoring integrations

The protocol integrates with third-party monitoring infrastructure for real-time incident detection. Covered protocols are required to participate in this monitoring as a condition of coverage. Alerts feed the Claims Registry and the Risk Consortium when an incident is detected.

External dependencies

Firelight's security posture depends on several external components: the host chain, oracle infrastructure, custody providers, and liquidation counterparties. Due diligence on these is part of the Network's ongoing responsibility, and incidents at any of these layers are reflected in the monitored risk view for affected markets.

Incident response

If an incident affects the coverage protocol itself (rather than a covered protocol), active operations may be paused to contain the issue, the Network coordinates with service providers and auditors to assess scope, affected participants are notified through official channels, and a post-mortem is published once remediation is complete. Pausing is reserved for genuine emergencies, not routine operations.

Where to read next

• Links & Contact for the bug bounty channel and full cover terms.