Protocol security
Independent audits, transparent issue disclosure and private vulnerability reporting keep security at the forefront.
Audit reports
V2
V1Surf V2 Audit ReportThe independent V2 audit report will be published here soon.
ForthcomingPublishing soonSurf V1 Audit Report #2Independent audit report for the Surf V1 smart contracts.
5 Nov 2025Read reportV1Surf V1 Audit Report #1Independent audit report for the original Surf lending smart contracts.
7 Jul 2025Read reportKnown issues and mitigations disclosure register
Preparing disclosure
Published before the bounty opens
Surf will publish reviewed known issues here before opening the public bug bounty. Each entry will explain what is affected, the practical impact, the mitigation currently in place and whether a permanent fix is planned or complete.
Bug bounty planned · scope: deployed contracts
CriticalStealing user funds, locking them permanently, or minting tokens that shouldn't exist
TBDHighLocking funds temporarily, or taking yield or rewards that belong to someone else
TBDMediumBlocking other users' orders, forcing the protocol to waste ADA on transaction fees, or breaking internal accounting without causing a loss of funds
TBDLowSmaller issues and best-practice gaps that could plausibly cause harm
TBDHow it will work
The bounty will open after the known-issues register and V2 audit materials are published. Private security reports are welcome in the meantime.
1Report privately. Never exploit on mainnet or disclose publicly first.
2Show that it works by including a proof of concept against the deployed contracts or a fork of them.
3Severity is assessed on impact and likelihood; payout lands within 14 days of a confirmed fix.
Planned scope: deployed Surf V1 and V2 validators and the staking distributor. The web frontend, third-party oracles, published known issues and duplicate reports are out of scope.
Legal notice: exploiting a vulnerability against user or protocol funds may constitute a criminal offence. Good-faith research is covered by safe harbor when it follows this policy, remains private, avoids mainnet exploitation and does not exfiltrate data.
Report a security issueSecurity practices
Open & verifiable
The V1 smart-contract source and audit reports are public. V2 source will be published after launch.
Transaction integrity
Your signature commits to the transaction's inputs, outputs, fees and script actions. If those conditions are no longer valid, the transaction fails rather than changing.
Conservative parameters
LTV caps, per-pool collateral configs and utilization-aware rates are set conservatively. Governance can take on more parameter decisions over time.