Skip to main content
Aura holds user collateral in on-chain contracts, so the honest version of a security page has to cover two things: what the contracts do to protect funds without trusting us, and what still depends on trusting us. Both are below.

​
What protects funds without trusting Aura

These are properties of the contracts. They hold whether or not we behave.
Winnings go to the position holder. Creator fees go to the recorded market creator. Trading fees go to the treasury address the factory currently points at. None of these accept a destination from the caller, so there is no admin call that redirects a user’s payout somewhere else.
Tearing down a resolved market requires every fee bucket to be empty and no unclaimed winnings to remain. The contract refuses otherwise. Cleanup cannot be used to strand funds.
Creator fees, treasury fees, and referral fees accrue in separate buckets with independent bounds. Draining or miscounting one cannot reach into another or into trader collateral.
Finalizing an outcome, running the penalty passes, and cleaning up voter records are all permissionless. If Aura went dark tomorrow, anyone could still push a resolved market through to the point where winners can claim.
Every governance setter follows propose, wait, then execute. Mainnet delay is 24 hours, and there is no setter that shortens it. You get a full day of visible warning before a treasury, oracle, vault, or voting pointer changes.
Total slashing is capped at 1% of everything staked per rolling 24-hour window. Past the cap the contract clamps the penalty rather than reverting, so a bug or an attack in the penalty path cannot cascade into the vault. Individual voters risk 0.1% of their committed balance per losing vote.
Traders and stakers must be externally owned accounts, not contracts. This keeps the slashing and reward paths solvent, and it stops a contract from being used to hold a position that penalties cannot reach.

​
Dispute economics

Resolution is optimistic: someone proposes an outcome with a bond and it stands unless challenged. The numbers are what make lying unprofitable. A false outcome costs the proposer their bond. Disputing a correct outcome costs the challenger theirs. Voting with the losing side costs stakers a slice of their vault balance. See Resolution and disputes for the full mechanics.

​
Emergency controls

Pausing is deliberately not timelocked. If something is actively going wrong, waiting 24 hours to stop it is worse than the risk of having a fast switch. The factory, oracle, vault, and voting contracts can each be paused immediately. Pausing stops new activity. It does not seize funds, change any recorded position, or alter an outcome that has already been finalized. Because a pause can interrupt a dispute round mid-flight, there is a matching recovery path that voids the interrupted round and refunds its bonds. It cannot void a round that already completed, so a pause cannot be used to erase a resolution that went against the operator.

​
Trust assumptions that remain

Being straight about the parts that are not trustless:
  • Governance keys can rotate the treasury, oracle, vault, and voting addresses, subject to the 24-hour timelock. Intended to be a multisig in production.
  • The pause switch is immediate and has no timelock by design.
  • Treasury operators can route protocol revenue on resolved markets. Not user funds.
  • The indexer and API are operated by Aura. They are a convenience layer over chain state, not a source of truth. Every balance, position, and outcome can be read directly from the contracts, and you should verify against the chain if the stakes justify it.
  • Market resolution rules are written by whoever proposed the market. A badly worded market is a real risk that no amount of contract security fixes. Read the rules before trading.

​
Reporting a vulnerability

If you have found something, please report it privately first. We will not pursue action against anyone acting in good faith under this policy.

security@aura.markets

Include enough detail to reproduce: affected contract or endpoint, the impact you believe it has, and the steps to trigger it. A proof of concept against testnet is welcome and makes triage much faster.
What we ask:
  • Report privately and give us a chance to ship a fix before disclosing.
  • Test on testnet, not mainnet. Do not test against other people’s funds or positions.
  • No social engineering of Aura staff or users, no denial of service, no spam.
What you can expect: acknowledgement within 72 hours, an assessment with a severity call, and credit in the fix announcement if you want it.
A formal bug bounty program is not live yet. Reports are triaged and rewarded at our discretion in the meantime, and the program details will be published here when it launches.

​
Protecting yourself

Most losses in crypto are not contract exploits.
1

Verify addresses against this site

Contracts is the canonical list. An address from a DM, a reply, or a lookalike domain is not.
2

Nobody at Aura will ask for your seed phrase

Not support, not a moderator, not a giveaway. There is no situation where Aura needs it. Anyone asking is stealing.
3

Back up your seed phrase before it matters

If you use the embedded wallet, export and store your seed offline. It is the only way back into your funds if you lose access to your login. See Passkeys and recovery.
4

Read what you sign

Every trade, stake, and vote is a transaction you approve. Check the amount and the contract before confirming.
Last modified on July 29, 2026