> ## Documentation Index
> Fetch the complete documentation index at: https://docs.defindex.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Risks and Audits

## Risks

### Smart Contracts

DeFindex is built on smart contracts. In the event of a hack, funds could be at risk.

### Underlying Protocols

Because DeFindex integrates with external DeFi protocols, vulnerabilities in those protocols may affect vault performance.

### Risk Mitigation

DeFindex minimizes risk through safeguards enforced at the smart contract level:

* **Whitelisted strategies only.** Each vault's strategies are defined when the vault is created. Deposits can only be invested into these whitelisted strategies, and no vault function adds or swaps a strategy afterwards. The one path that can change them is a contract upgrade: a vault deployed as upgradable lets its Manager replace the vault's code entirely, while a vault deployed with upgradability disabled makes the strategy list permanent.
* **Funds never leave the vault's ecosystem.** Rebalancing can only move funds between the vault and its whitelisted strategies: unwound funds are hard-coded to return to the vault, and no role can make the vault transfer assets to an arbitrary address.
* **Rescue function.** Vault Managers and Emergency Managers can trigger a **rescue function**, which safely unwinds all funds from an underlying strategy back to the vault, where only users can withdraw. This enables proactive risk management in collaboration with chain analysis tools.
* **Strategy pausing.** Managers and Emergency Managers can pause a strategy, blocking new investments into it while user withdrawals remain fully available.
* **Withdrawals are always open.** No role can freeze user deposits or withdrawals: users can always exit with their share of the vault.
* **Fees only on yield.** Fees accrue exclusively on positive gains; user principal is never charged.
* **First-deposit protection.** Vaults enforce a minimum liquidity of locked "dead shares" on the first deposit, protecting depositors against share-inflation attacks.

You can verify these mechanisms directly in the open-source contracts: [defindex-io/stellar-contracts](https://github.com/defindex-io/stellar-contracts).

## Audits

| Auditor                                                        | Scope                                                                 | Date    | Report                                                                                                                                                                             |
| -------------------------------------------------------------- | --------------------------------------------------------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [OtterSec](https://osec.io/audits)                             | DeFindex Vault<br />DeFindex Factory<br />Blend Autocompound Strategy | 2025-03 | [DeFindex Security Assessment](https://github.com/defindex-io/stellar-contracts/blob/main/docs/audits/2025_03_18_ottersec_defindex_audit.pdf)                                      |
| [Runtime Verification](https://runtimeverification.com/audits) | APY Stabilizer FeeProxy<br />APY Stabilizer BoostTreasury             | 2026-07 | [DeFindex APY Stabilizer Audit Report](https://github.com/runtimeverification/publications/blob/main/reports/smart-contracts/DeFindex%20APY%20Stabilizer-Audit%20Report-Final.pdf) |

### Underlying Protocol Audits

DeFindex uses underlying protocols. These protocols have been independently audited:

| Protocol | Number of Audits | Audits                                                                      |
| -------- | ---------------- | --------------------------------------------------------------------------- |
| Blend V2 | 3                | [View audits](https://docs.blend.capital/audits-and-bug-bounties#v2-audits) |
| K2       | 3                | [View audits](https://docs.k2lend.com/security-and-audits)                  |