> ## Documentation Index
> Fetch the complete documentation index at: https://docs.synclear.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Audits and Responsible Disclosure at Synclear

> Synclear's audit history, bug bounty program, responsible disclosure process, formal verification status, and ongoing security monitoring practices.

Security is a foundational requirement for a protocol operating at the intersection of institutional credit and on-chain infrastructure. Synclear subjects its smart contract codebase to rigorous third-party security audits prior to each major release, maintains an active bug bounty program, and applies continuous on-chain monitoring to detect anomalous activity in real time.

This page documents the current state of Synclear's security posture, including completed and in-progress audits, the bug bounty scope and reward structure, and guidance for responsible disclosure of identified vulnerabilities.

## Audit History

The table below reflects the status of all commissioned audit engagements. Reports for completed audits are publicly available via the links in each row. Pending audits are in progress at time of publication.

| Auditor                                      | Scope                                                              | Status    | Report |
| -------------------------------------------- | ------------------------------------------------------------------ | --------- | ------ |
| [Trail of Bits](https://www.trailofbits.com) | Core credit protocol: CreditPoolFactory, BorrowRouter, TrustScorer | Pending   | —      |
| [Spearbit](https://spearbit.com)             | Savings vault architecture: VaultFactory, yield strategy contracts | Pending   | —      |
| [Sigma Prime](https://sigmaprime.io)         | MandateRegistry, AI agent execution layer                          | Scheduled | —      |
| [Code4rena](https://code4rena.com)           | Full protocol competitive audit (community + judges)               | Planned   | —      |

<Note>
  Audit reports will be published in full on the [Synclear GitHub repository](https://github.com/synclear) as each engagement concludes. Synclear does not selectively publish audit results; all findings, including critical and high-severity issues, will be disclosed along with remediation details. Security-related announcements are published through the official Synclear changelog.
</Note>

## Bug Bounty Program

Synclear operates a public bug bounty program to incentivize responsible disclosure from the security research community. The program is hosted on [Immunefi](https://immunefi.com) and covers all contracts deployed in the production protocol.

### Reward Structure

| Severity                | Maximum Reward       | Criteria                                                                                                      |
| ----------------------- | -------------------- | ------------------------------------------------------------------------------------------------------------- |
| **Critical**            | Up to \$500,000 USDC | Direct loss of user funds, complete protocol compromise, unauthorized minting or extraction.                  |
| **High**                | Up to \$50,000 USDC  | Significant impact on protocol functionality, partial fund exposure, governance manipulation.                 |
| **Medium**              | Up to \$10,000 USDC  | Denial of service, oracle manipulation without direct fund loss, access control bypasses with limited impact. |
| **Low / Informational** | Up to \$1,000 USDC   | Code quality issues, best practice deviations, low-impact edge cases.                                         |

Rewards are paid in USDC. Duplicate submissions, previously known issues, and vulnerabilities in out-of-scope contracts are not eligible. Full program terms, scope, and exclusions are defined on the Immunefi program page.

<Note>
  Bug bounty program link: [immunefi.com/bounty/synclear](https://immunefi.com/bounty/synclear) — verify this URL independently via Synclear's official GitHub and social channels before submitting.
</Note>

## Responsible Disclosure Policy

Security researchers who identify vulnerabilities in Synclear's contracts, infrastructure, or application layer are asked to adhere to the following responsible disclosure guidelines:

1. **Do not exploit the vulnerability.** Do not use a discovered vulnerability to extract funds, manipulate protocol state, or test on production contracts beyond what is necessary to confirm the issue.
2. **Submit privately.** Report vulnerabilities via the Immunefi platform or, for issues outside the bug bounty scope, to `security@synclear.io` with PGP encryption (public key available on the Synclear GitHub).
3. **Allow remediation time.** Synclear commits to acknowledging submissions within 48 hours and providing a remediation timeline within 7 business days. Public disclosure is coordinated with the reporter after a fix is deployed.
4. **Do not disclose publicly before remediation.** Premature public disclosure that puts user funds at risk will be treated as outside the responsible disclosure process and may affect reward eligibility.

## Formal Verification

Formal verification of select protocol invariants is planned for the core credit pool state machine and liquidation logic prior to mainnet launch. Synclear is evaluating tooling (Certora Prover, Halmos) for this work. The scope, methodology, and output of formal verification engagements will be published alongside audit reports.

## Ongoing Security Monitoring

Synclear maintains real-time protocol monitoring through the following mechanisms:

* **On-chain anomaly detection** via integration with security monitoring platforms (Forta, OpenZeppelin Defender) that alert on unusual transaction patterns, large fund movements, and access control events.
* **Price oracle monitoring** with circuit breakers that halt protocol operations if oracle price deviation exceeds defined thresholds.
* **Timelocked governance** on all protocol upgrades, with a mandatory delay between proposal passage and execution — providing a response window in the event of a governance attack.
* **Incident response team** on call 24/7 with the ability to trigger emergency pause functionality on affected contracts. The pause guardian address is publicly disclosed and multisig-controlled.