Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/reserve-protocol/reserve-index-dtf/llms.txt

Use this file to discover all available pages before exploring further.

​
Overview

Reserve Folio has undergone multiple comprehensive security audits by leading security firms. This page provides information about completed audits and their findings.
All critical and high-severity findings from audits have been addressed before deployment.

​
Completed Audits

​
Trust Security - v1.0.0

December 2024

Auditor: Trust SecurityVersion: 1.0.0 (Initial Release)Focus: Non-repeatable pairwise auctionsReport: Available in the audits directory

​
Cantina - Competition Audit

January 2025

Auditor: Cantina (Competition Format)Version: Multiple versions reviewedFormat: Public competition with multiple security researchersReport: Available in the audits directory
Competition audits leverage the “wisdom of the crowd” with multiple independent security researchers competing to find vulnerabilities.

​
Trail of Bits - v2.0.0

April 2025

Auditor: Trail of BitsVersion: 2.0.0 (Repeatable Auctions)Focus: Repeatable pairwise auctions, dust limits, minimum mint enforcementReport: Available in the audits directory
This audit covered significant new features including repeatable auctions and dust limit mechanisms.

​
Trail of Bits - v4.0.0

June 2025

Auditor: Trail of BitsVersion: 4.0.0 (Basket Auctions)Focus: Rebalance targets, trusted fillers integration, auction overhaulReport: Available in the audits directory
Version 4.0.0 represented a major architecture change from pairwise to basket-level auctions.

​
Pashov Audit Group - v4.0.0+

June 2025

Auditor: Pashov Audit GroupVersion: 4.0.0 and subsequent updatesFocus: Comprehensive security reviewReport: Available in the audits directory

​
Audit Timeline

1

December 2024

Trust Security - v1.0.0 audit completedInitial release audit covering core functionality
2

January 2025

Cantina Competition - Public audit competitionMultiple researchers reviewed the protocol
3

April 2025

Trail of Bits - v2.0.0 audit completedRepeatable auctions and new features
4

June 2025

Trail of Bits & Pashov - v4.0.0 audits completedMajor architecture changes reviewed

​
Key Security Features

​
Reentrancy Protection

All mutator functions use nonReentrant modifiers to prevent reentrancy attacks.Async actions are closed as a pre-hook before state changes.
While the Folio itself is protected, consuming protocols should check:
(bool rebalanceActive, bool asyncActionActive) = folio.stateChangeActive();
require(!rebalanceActive && !asyncActionActive);

​
Access Control

Role-Based Permissions

The protocol uses OpenZeppelin’s AccessControl for fine-grained permissions:
  • DEFAULT_ADMIN_ROLE: Full administrative control
  • REBALANCE_MANAGER: Rebalancing operations
  • AUCTION_LAUNCHER: Auction initiation and management
Each role has specific, limited capabilities.

​
Price Protection

Maximum price range per auction: 100x (4 orders of magnitude)Prevents extreme price manipulation.
AUCTION_LAUNCHER can only operate within bounds set by REBALANCE_MANAGER.Limits potential damage from compromised launcher.

​
Overflow Protection

Safe Arithmetic

All arithmetic uses:
  • Solidity 0.8+ built-in overflow checks
  • Carefully designed ranges to prevent overflow
  • D18 and D27 precision with validated limits

​
Security Considerations

​
Trusted Roles

Semi-Trusted AUCTION_LAUNCHERThe AUCTION_LAUNCHER role is semi-trusted and can:
  • Open auctions within governance-approved ranges
  • Potentially cause value leakage if malicious (depending on PriceControl setting)
  • Block rebalancing by staying offline
Mitigation: Permissionless auction opening after restricted period expires.

​
Price Control Modes

Risk Level: LowAUCTION_LAUNCHER cannot modify prices. Must use governance-set ranges.Best for: Most Folios, especially those with public/untrusted launchers.
Risk Level: MediumAUCTION_LAUNCHER can select subset of price range.Risks:
  • Can begin auctions at suboptimal prices
  • Value leakage to MEV searchers possible
  • Cannot guarantee they benefit from leaked value
Best for: Folios with trusted launchers needing price precision.
Risk Level: HighAUCTION_LAUNCHER can perform atomic swaps at fixed prices.Risks:
  • Full control over clearing price
  • Can internalize MEV
  • Value leakage with guaranteed beneficiary (launcher)
Best for: Highly trusted, sophisticated launchers with strong accountability.

​
Token Risks

Governance must carefully vet tokens before inclusion. See Token Compatibility for details.Key risks:
  • Pausable tokens can freeze the Folio
  • Fee-on-transfer breaks accounting
  • Rebasing tokens can cause accounting drift

​
MEV Exposure

Dutch auctions are inherently exposed to MEV. Mitigation strategies:
  1. Tight Price Ranges: Reduce arbitrage opportunities
  2. Trusted Fillers: Use CoW Swap for MEV protection
  3. Active Launcher: Responsive AUCTION_LAUNCHER improves execution
  4. Permissionless Fallback: Ensures liveness even if launcher is offline

​
Vulnerability Disclosure

If you discover a security vulnerability:
  1. DO NOT create a public GitHub issue
  2. See the Bug Bounty Program for responsible disclosure
  3. Contact the team through secure channels

Responsible Disclosure

Reserve Protocol values the security community’s contributions and rewards responsible disclosure through its bug bounty program.

​
Audit Reports Access

All audit reports are available in the source repository: 
audits/
├── cantina/
│   └── report-competition-reserve-jan2025.pdf
├── pashov/
│   └── reserve-security-review_2025-06-02.pdf
├── trail-of-bits/
│   ├── 2025-04-reserve-folio-solidity-2.0.0.pdf
│   └── 2025-06-reserve-folio-solidity-4.0.0.pdf
└── trust-security/
    └── v1-audit-dec-2024.pdf

​
Continuous Security

1

Regular Audits

Major releases undergo comprehensive security audits
2

Bug Bounty Program

Ongoing incentives for security researchers
3

Community Review

Open-source code allows continuous community scrutiny
4

Governance Oversight

Multi-signature and timelock governance reduces risk

Bug Bounty

Report vulnerabilities and earn rewards

Token Compatibility

Security considerations for different token types

Roles

Understanding access control and permissions

Governance

Governance security model

Build docs developers (and LLMs) love

Get started for freeTalk to us