> For the complete documentation index, see [llms.txt](https://docs.veda.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veda.tech/security-and-risk-controls/smart-contract-security.md).

# Smart Contract Security

Smart contract security governs the core vault architecture and operational safeguards, defining how the vault functions and constraining its capabilities to pre-approved actions. Veda's framework includes:

### Minimal Surface Area

Veda vaults expose only two public functions:

* **Deposit** to supply assets
* **Withdraw** to redeem assets

This reduced surface area minimizes potential attack vectors and defines a clear user interaction model, making reliable safeguards easier to build.

### Merkle Verification System

* Every action a vault can perform - whether deploying liquidity, staking or rebalancing - is pre-registered, hashed, and embedded in a Merkle tree
* Before executing any action, the vault must prove its inclusion in this Merkle root, ensuring that only pre-approved actions are executable
* This system makes it impossible for arbitrary transactions or strategy changes to occur

### Transaction Safeguards

* **Share Lock Period:** Newly issued vault shares are locked for a brief period to neutralize flash loan manipulation risks
* **Delayed Withdrawals:** Withdrawals are subject to a time delay, creating a monitoring window for identifying and responding to irregularities

### Onchain Monitoring

* Veda tracks both internal positions and external market dynamics.
* Veda also uses third-party monitoring systems to detect malicious behaviour targeting Veda contracts and the underlying protocols its vaults are exposed to.
* Veda vaults are also part of multiple ongoing bug bounty programs operated by our integration partners.

### Audits

Veda contracts are used by many of the top protocols in DeFi, including ether.fi, Plasma, Lombard, TAC, Rings, and TurtleClub, making the BoringVault one of the most audited DeFi contracts in production.

Audit firms commissioned to evaluate the BoringVault include Spearbit, Macro, Secure3 & Hexens.