Skip to main content

Security review

This is not an external audit

Covenant has had an internal security review only. It has not been audited by an independent third party. An external audit is required before any mainnet launch. Treat the protocol as an unaudited MVP.

Trust model​

Covenant is non-custodial and immutable:

  • No admin keys. There is no owner, no multisig, and no function that can change parameters, redirect the tax, or move user funds at will.
  • No upgrades. The contracts cannot be replaced or proxied. What ships is what runs.
  • Rules as constants. Retention, discount, tax, and duration are compile-time constants of the hook.

The immutable creator address receives the 3% ETH tax and seeds the pool. Its powers are limited to exactly that.

What was checked​

The internal review (July 2026) ran the standard toolchain:

ToolPurpose
SlitherStatic analysis for common Solidity vulnerability patterns.
MythrilSymbolic execution over the compiled bytecode.
Foundry50 tests, including fuzzing and a conservation invariant, plus an end-to-end anvil run.

Findings from the static tools were triaged: real issues were fixed, and accepted findings / tool false-positives were documented with reasoning.

Fixes worth calling out​

  • initialize front-run guard. afterInitialize now requires sender == poolInitializer, so the hook's mined CREATE2 address cannot be bound to a junk pool between deploy and initialize. The Queue and Vault use the same deployer-only initialization pattern.
  • Accounting hardening. Delta accounting was traced by hand for buys, sells, absorption, and expiry; rounding was made conservative (ceil where it protects the protocol).

Before mainnet​

An independent external audit is the gating requirement before mainnet. Until then, the docs and the dApp label the protocol as an unaudited testnet MVP. See the full list of caveats in Known risks.