Risks and Audits
⏱️ 1 min read
Smart Contracts
DeFindex is built on smart contracts. In the event of a hack, funds could be at risk.
Underlying Protocols
Because DeFindex integrates with external DeFi protocols, vulnerabilities in those protocols may affect vault performance.
Risk Mitigation
DeFindex minimizes risk through safeguards enforced at the smart contract level:
Whitelisted strategies only. Each vault's strategies are defined when the vault is created. Deposits can only be invested into these whitelisted strategies — there is no contract function to add or swap strategies afterwards.
Funds never leave the vault's ecosystem. Rebalancing can only move funds between the vault and its whitelisted strategies: unwound funds are hard-coded to return to the vault, and no role can make the vault transfer assets to an arbitrary address.
Rescue function. Vault Managers and Emergency Managers can trigger a rescue function, which safely unwinds all funds from an underlying strategy back to the vault — where only users can withdraw. This enables proactive risk management in collaboration with chain analysis tools.
Strategy pausing. Managers and Emergency Managers can pause a strategy, blocking new investments into it while user withdrawals remain fully available.
Withdrawals are always open. No role can freeze user deposits or withdrawals — users can always exit with their share of the vault.
Fees only on yield. Fees accrue exclusively on positive gains; user principal is never charged.
First-deposit protection. Vaults enforce a minimum liquidity of locked "dead shares" on the first deposit, protecting depositors against share-inflation attacks.
You can verify these mechanisms directly in the open-source contracts: defindex-io/stellar-contracts.
Audits
Audit Report by OtterSec: View the report
For a detailed evaluation of DeFindex’s security and compliance, refer to the audit report conducted by OtterSec. You can also browse all OtterSec audits at osec.io/audits.
Underlying Protocols
DeFindex uses underlying protocols. These protocols have been independently audited:
Last updated