Skip to main content
Security is a foundational requirement for a protocol operating at the intersection of institutional credit and on-chain infrastructure. Synclear subjects its smart contract codebase to rigorous third-party security audits prior to each major release, maintains an active bug bounty program, and applies continuous on-chain monitoring to detect anomalous activity in real time. This page documents the current state of Synclear’s security posture, including completed and in-progress audits, the bug bounty scope and reward structure, and guidance for responsible disclosure of identified vulnerabilities.

​
Audit History

The table below reflects the status of all commissioned audit engagements. Reports for completed audits are publicly available via the links in each row. Pending audits are in progress at time of publication.
Audit reports will be published in full on the Synclear GitHub repository as each engagement concludes. Synclear does not selectively publish audit results; all findings, including critical and high-severity issues, will be disclosed along with remediation details. Security-related announcements are published through the official Synclear changelog.

​
Bug Bounty Program

Synclear operates a public bug bounty program to incentivize responsible disclosure from the security research community. The program is hosted on Immunefi and covers all contracts deployed in the production protocol.

​
Reward Structure

Rewards are paid in USDC. Duplicate submissions, previously known issues, and vulnerabilities in out-of-scope contracts are not eligible. Full program terms, scope, and exclusions are defined on the Immunefi program page.
Bug bounty program link: immunefi.com/bounty/synclear — verify this URL independently via Synclear’s official GitHub and social channels before submitting.

​
Responsible Disclosure Policy

Security researchers who identify vulnerabilities in Synclear’s contracts, infrastructure, or application layer are asked to adhere to the following responsible disclosure guidelines:
  1. Do not exploit the vulnerability. Do not use a discovered vulnerability to extract funds, manipulate protocol state, or test on production contracts beyond what is necessary to confirm the issue.
  2. Submit privately. Report vulnerabilities via the Immunefi platform or, for issues outside the bug bounty scope, to security@synclear.io with PGP encryption (public key available on the Synclear GitHub).
  3. Allow remediation time. Synclear commits to acknowledging submissions within 48 hours and providing a remediation timeline within 7 business days. Public disclosure is coordinated with the reporter after a fix is deployed.
  4. Do not disclose publicly before remediation. Premature public disclosure that puts user funds at risk will be treated as outside the responsible disclosure process and may affect reward eligibility.

​
Formal Verification

Formal verification of select protocol invariants is planned for the core credit pool state machine and liquidation logic prior to mainnet launch. Synclear is evaluating tooling (Certora Prover, Halmos) for this work. The scope, methodology, and output of formal verification engagements will be published alongside audit reports.

​
Ongoing Security Monitoring

Synclear maintains real-time protocol monitoring through the following mechanisms:
  • On-chain anomaly detection via integration with security monitoring platforms (Forta, OpenZeppelin Defender) that alert on unusual transaction patterns, large fund movements, and access control events.
  • Price oracle monitoring with circuit breakers that halt protocol operations if oracle price deviation exceeds defined thresholds.
  • Timelocked governance on all protocol upgrades, with a mandatory delay between proposal passage and execution — providing a response window in the event of a governance attack.
  • Incident response team on call 24/7 with the ability to trigger emergency pause functionality on affected contracts. The pause guardian address is publicly disclosed and multisig-controlled.