Security & trust

Custody#

User funds sit in the contracts, never in an operator's wallet. No contract has a function that lets an admin move a user's balance, margin or vault shares. None of the contracts is upgradeable.

What the owner can do#

Ownership is two-step (Ownable2Step) on every contract that has an admin, and every numeric setting is bounded in code. Ladder pools, launch tokens, the floor book, fraction vaults and routes have no admin at all, and a ladder vault answers only to the account that owns it.

• Markets — list markets and change their parameters within limits (leverage at most 50×, maintenance below initial margin, fees and spread at most 1%, funding at most 1% a day). A market can be set close-only.
• Engine — utilisation, reserve, profit cap and price-age limits within bounds; a protocol share of trading fees of up to 50%.
• Vault — the exit fee (at most 1%), and the external ERC-4626 strategy that idle USDG may be allocated to.
• Dark pool — fees (at most 1%), batch limits and price-age limits.
• Oracle — the signer set and signature threshold.
• Ladders — which quote tokens pools may use, which contracts may create pools (the launchpad), and the operator suggested to new vaults. The owner cannot touch a pool's reserves or a vault's funds, and cannot change a vault's operator.
• Launchpad — which route contract each route id uses for new launches. An existing launch keeps its route; the locked ladder can't be withdrawn by anyone.
• Pause — a guardian can pause new risk: perp opens and margin removal, vault deposits, dark-pool commits and deposits. Closing positions, adding margin, liquidations, vault withdrawals and dark-pool reveals, settlement and withdrawals keep working. Ladder pools and the launchpad have no pause.

Trust assumptions#

• AevumFi accounts. The key of your AevumFi account is derived by the AevumFi server from your wallet address, once you have signed in, and kept in your browser. Whoever runs that server could derive any account's key and act for it — the contracts' custody guarantees apply to the contracts, not to that key. Anyone with access to your browser's storage could too.
• Oracle signers. Signers can publish any price that passes the freshness and consistency checks. A compromised signer key could mis-price positions. Raising the threshold to several independent signers reduces this risk.
• Vault strategy. Funds the owner allocates to an external ERC-4626 venue carry that venue's risk. The contract won't allocate USDG backing open trader profits or the open-interest reserve.
• Market data. Index quotes come from a public data source. Some venues' quotes run about 15 minutes late, so an index can move before the oracle reflects it. The spread, the 20-minute market-hours window and per-market caps limit the effect, but don't remove it.
• Ladder operators. An operator can only re-centre a vault, and only within the owner's limits — but it chooses when. The EMA guard stops it acting on a price pushed within the last few minutes; it can't stop a price that has genuinely moved. The owner can revoke the operator at any time.
• Launched tokens and collections. Anyone can launch a token, and a floor backstop buys whatever the chosen collection's floor listing is. Neither AevumFi nor the contracts vouch for either.

Testing#

The Foundry suite has unit and fuzz tests for every module, plus a stateful invariant campaign that runs random trading — opens, partial and full closes, price moves, time passing, liquidations, orders — and checks after every step that:

• no USDG is created or destroyed;
• the engine holds exactly the margin of open positions plus order escrows;
• each market's aggregate sums equal the sums over its positions;
• the vault's liability figure matches the positions' own PnL and funding.

Ladder pools have their own invariant campaign — random adds, removals, swaps and fee collections by several accounts — checking after every step that the pool holds every reserve and every fee it owes, that bids sit only below the price and asks only above it, that shares add up, and that the bin index marks exactly the funded bins. The launch token's pro-rata distribution is fuzzed across random transfers, burns and distributions, and the fee routes are tested at every gas limit a wallet might pick: a harvest that succeeds always ran its route.

Responsible disclosure#

Report vulnerabilities privately through AevumFi's X account before disclosing them publicly.