> For the complete documentation index, see [llms.txt](https://docs.defindex.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.defindex.io/advanced-documentation/risks-and-audits.md).

# Risks and Audits

## **Smart Contracts**

DeFindex is built on smart contracts. In the event of a hack, funds could be at risk.

## Underlying Protocols

Because DeFindex integrates with external DeFi protocols, vulnerabilities in those protocols may affect vault performance.

## Risk Mitigation

DeFindex minimizes risk through safeguards enforced at the smart contract level:

* **Whitelisted strategies only.** Each vault's strategies are defined when the vault is created. Deposits can only be invested into these whitelisted strategies — there is no contract function to add or swap strategies afterwards.
* **Funds never leave the vault's ecosystem.** Rebalancing can only move funds between the vault and its whitelisted strategies: unwound funds are hard-coded to return to the vault, and no role can make the vault transfer assets to an arbitrary address.
* **Rescue function.** Vault Managers and Emergency Managers can trigger a **rescue function**, which safely unwinds all funds from an underlying strategy back to the vault — where only users can withdraw. This enables proactive risk management in collaboration with chain analysis tools.
* **Strategy pausing.** Managers and Emergency Managers can pause a strategy, blocking new investments into it while user withdrawals remain fully available.
* **Withdrawals are always open.** No role can freeze user deposits or withdrawals — users can always exit with their share of the vault.
* **Fees only on yield.** Fees accrue exclusively on positive gains; user principal is never charged.
* **First-deposit protection.** Vaults enforce a minimum liquidity of locked "dead shares" on the first deposit, protecting depositors against share-inflation attacks.

You can verify these mechanisms directly in the open-source contracts: [defindex-io/stellar-contracts](https://github.com/defindex-io/stellar-contracts).

## Audits

**Audit Report by OtterSec:** [View the report](https://github.com/defindex-io/docs/blob/main/audits/2025_03_18_ottersec_defindex_audit.pdf)

For a detailed evaluation of DeFindex’s security and compliance, refer to the audit report conducted by [**OtterSec**](https://osec.io). You can also browse all OtterSec audits at [osec.io/audits](https://osec.io/audits).

### Underlying Protocols

DeFindex uses underlying protocols. These protocols have been independently audited:

| Protocol | Number of Audits | Audits                                                                      |
| -------- | ---------------- | --------------------------------------------------------------------------- |
| Blend V2 | 3                | [View audits](https://docs.blend.capital/audits-and-bug-bounties#v2-audits) |