mirror of
https://github.com/luxfi/audits.git
synced 2026-10-30 17:02:11 +00:00
zeekayandHanzo Dev
6aedbe7c6a
Bylines, paper authorship, correspondence addresses and the founder blurb under each post named an individual. They name the organisation that published the work instead: the brand on posts and pages, the research byline on papers, and research@ in place of a personal address. Both are what these repositories already used elsewhere — nothing new was coined. Co-authors are untouched. Where a paper named someone else alongside, they stay named; only the one byline changed. Bibliography entries, running heads, PDF metadata and affiliations move with it, so a citation still resolves to whoever the cited paper names. Sample and fixture data uses the placeholder name these tests already use elsewhere, so no assertion changed meaning. Co-authored-by: Hanzo Dev <[email protected]>
Lux Security Audits
This directory contains security audit reports for Lux ecosystem smart contracts.
Audits
| Date | Project | Tests | Critical | High | Medium | Status |
|---|---|---|---|---|---|---|
| 2026-03-25 | standard + liquid + liquidity | 1,383 pass | 15 | 13 | 10 | Complete |
| 2026-01-30 | @luxfi/standard | 832 pass | 25 | 41 | 40 | Complete |
Directory Structure
audits/
├── README.md # This file
├── 2026-03-25-comprehensive-security-audit.md # Multi-repo audit (standard + liquid + liquidity)
└── standard-2026-01-30/ # Lux Standard audit
├── AUDIT_BRIDGE.md # Bridge contracts (4 critical)
├── AUDIT_CRYPTO.md # Cryptography (2 critical)
├── AUDIT_DID.md # Identity contracts (2 critical)
├── AUDIT_GAS_DOS.md # Gas/DoS vectors (4 critical)
├── AUDIT_GOVERNANCE.md # Governance (4 critical)
├── AUDIT_LIQUID.md # Liquid tokens (3 critical)
├── AUDIT_TREASURY.md # Treasury (6 critical)
├── AUDIT_SUMMARY.md # Executive summary
└── SECURITY_MEASURES.md # Remediation plan
Security Standards
See LIP-7007: Security Standards for mandatory security requirements.
Audit Process
- Static Analysis - Slither (fail-on: medium), Semgrep (solidity + smart-contracts), Aderyn (Cyfrin)
- Fuzz Testing - Foundry invariant tests + fuzz tests (1,000 runs)
- Symbolic Execution - Halmos (proves properties for ALL inputs)
- Formal Verification - Lean 4 with Mathlib (consensus-layer theorems)
- Adversarial Review - Red/Blue agent team manual code review
- Report Generation - Findings documented with severity, CVSS, and remediation
Pre-Deployment Checklist
Before mainnet deployment, ensure:
- All critical issues fixed
- All high issues fixed or risk-accepted
- External audit completed (Trail of Bits, OpenZeppelin, etc.)
- Bug bounty program active
- Monitoring and alerting deployed
Contact
For security issues: [email protected]