Security

SECURITY.md

Security Policy

Audit Status

YearRing Fund Protocol has not yet completed a third-party external audit.

Current status:

Internal review: ongoing
Mainnet validation: in progress
External audit: pending
Public bug bounty: not yet active

Responsible Disclosure

If you discover a potential vulnerability, please contact:

security@yearringfund.com

Please do not publicly disclose vulnerabilities before the team has had a reasonable opportunity to investigate and respond.

Scope

Current security focus includes:

FundVaultV01
StrategyManagerV01
AaveV3StrategyV01
LockRewardManagerV02
LockLedgerV02
RewardToken
GovernanceSignalV02
ProtocolTimelockV02

Known Limitations

The protocol is currently in an early validation phase.

Users and reviewers should assume:

smart contract risk exists;
strategy integration risk exists;
governance and admin configuration risk exists;
oracle, accounting, and liquidity risks may exist in future RWA versions;
external audit is still pending.

Contact

Official website: https://yearringfund.com
Official app: https://app.yearringfund.com
Official docs: https://docs.yearringfund.com
Security contact: security@yearringfund.com

There aren't any published security advisories