Audits & Bug Bounty

Includes multiple smart contract audits conducted with Quantstamp and Cantina, along with a continuous bug bounty program to ensure ongoing security and resilience.

Audits

POR Vault Contracts (1st December, 2025)

Quantstamp Private Audit Report

The Quantstamp private audit report on POR smart contracts highlighted 1 high and 1 medium issue, all of which were promptly addressed and subsequently verified by the auditors.

afiUSD Contracts (1st August, 2025)

Cantina Private Audit Report

The Cantina private audit report on afiUSD smart contracts highlighted 1 critical issue along with a few medium and low-level issues, all of which were promptly addressed and subsequently verified by the auditors.

608KB

cantina_afi_x_jul2025.pdf

PDF

Open

afiUSD Security Review Report by Independent Researchers ( 20th August, 2025)

The audit report by independent researchers, zuhaibmohd and 0xWeb3boy on AfiUSD smart contracts highlighted a few low-level issues, all of which were promptly addressed and subsequently verified by the auditors.

46KB

afiUSD_Audit_Review.pdf

PDF

Open

---

Bug Bounty & Responsible Disclosure Program

At AFI, we prioritize user trust and adhere to the highest privacy and security standards. To reinforce this commitment, we actively invite security researchers to identify vulnerabilities and collaborate with us in resolving them swiftly and effectively. We value the security research community and fully support responsible disclosure. Through our Bug Bounty Program, we reward researchers who help enhance the security and resilience of the afiUSD ecosystem.

Responsible Disclosure Program Rules

• Include detailed, reproducible steps in your reports. Issues that cannot be reproduced will not be eligible for rewards.

• Submit one vulnerability per report unless multiple vulnerabilities need to be chained to demonstrate impact. In cases of duplicate reports, only the first reproducible submission will be rewarded.

• Vulnerabilities stemming from the same root cause will be treated as a single issue and awarded a single bounty.

• Social engineering attacks (e.g., phishing, vishing, smishing) are strictly prohibited.

• Do NOT exploit or test vulnerabilities on the afiUSD mainnet contracts. Use test/fork environments only.

• Only Medium- and High-severity vulnerabilities are eligible for rewards. Low-severity or informational findings are appreciated but may not qualify for payouts.

Reporting & Response

Researchers can report vulnerabilities by emailing our security team at [email protected]

• Initial Response: within 24 hours

• Issue Triage: within 2-3 business days

• Fix Timelines: vary based on severity

• Bounty Payments: processed after the fix is verified.