> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shores.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and audits

> Audits, admin functions, emergency pause and bug bounty.

## Audits

The contracts are reviewed with automated analysis and an independent audit before launch. Launch requires a completed audit with findings fixed and re-reviewed.

| Release | Scope | Auditor | Report |
| - | - | - | - |
| Launch | Vault, staking and permission contracts | \[TBD: audit firm] | \[TBD: report link] |

## Development practices

Built on OpenZeppelin libraries with Foundry. \[TBD: test coverage report]

## Admin functions

| Role | Can | Controls |
| - | - | - |
| Protocol admin | Upgrade or configure contracts, set fees within limits | \[TBD: multisig threshold and timelock] |
| Vault manager | Update NAV, record loan funding and repayments, run the monthly payout | \[TBD] |
| Permission admin | Add or remove verified addresses | \[TBD] |
| Pause guardian | Pause minting, staking or transfers in an emergency | \[TBD] |

### Timelocks

\[TBD: which actions are timelocked, and for how long]

### Upgradeability

\[TBD: whether contracts are upgradeable, and how upgrades are approved]

### Governance

Credit and collateral decisions are not put to token votes. See [Governance](/token-holders/governance).

## Emergency pause

\[TBD: who can pause, what can be paused (global, per contract, per function), and how unpausing works]

A pause stops onchain actions. It does not stop offchain loans: borrowers keep paying and servicers keep working while the contracts are paused.

## Bug bounty

\[TBD: bug bounty program and size]

## Monitoring

\[TBD: onchain monitoring]

## Assumptions

* NAV updates are only as accurate as the offchain loan book and its reporting.
* Admin keys are held as described in [Admin functions](#admin-functions).
* Robinhood Chain operates as expected.

\[TBD: full list of assumptions]

## Reporting a vulnerability

\[TBD: security contact]


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.