Security
Smart contract audits
Our EVM vaults are built on Lagoon's ERC-7540 vault infrastructure. Lagoon, built by Hopper Labs, is our vault infrastructure partner.
Lagoon publishes eleven reviews on its audits page, running from v0.1.0 in September 2024 to v0.6.0 in May 2026:
| Firm | Coverage |
|---|---|
| Nethermind Security | Eight reports across the release history, plus the January 2026 bug disclosure |
| Trail of Bits | Two reports, covering v0.5.0 and v0.6.0, the versions our vaults run |
The audited source is public at
github.com/hopperlabsxyz/lagoon-v0
under the Business Source License 1.1, with src/v0.5.1/ and src/v0.6.0/
matching those versions. Nethermind has written up the engagement at
Securing Lagoon's Asynchronous ERC-7540 Vaults.
⚠️ A bug was found after those audits. Lagoon published a low-level bug disclosure in January 2026, the first known bug in the protocol after multiple reviews.
⚠️ Our own code is not audited. The curator services, NAV computation, executors and permission configuration have not been through a third-party audit. There is no public bug bounty.
Custody
Working capital sits in a Gnosis Safe with three owners. Shares and accounting sit in the Lagoon vault contract. Neither is on our balance sheet or our servers. Settlement and bridging are signed by the curator as Safe transactions.
The Hyperliquid Native Vault is custodied by the venue's own vault mechanics and does not use this structure.
Verify it yourself
Owner sets, thresholds and enabled modules are public. Verify directly:
RPC=https://rpc.hyperliquid.xyz/evm
SAFE=0x33b7C2cE82784d79E7d658961fC74E0838b23a93
cast call --rpc-url $RPC $SAFE 'getOwners()(address[])'
cast call --rpc-url $RPC $SAFE 'getThreshold()(uint256)'
cast call --rpc-url $RPC $SAFE 'getModulesPaginated(address,uint256)(address[],address)' \
0x0000000000000000000000000000000000000001 10
Scoped signing keys
Zodiac Roles Modifier v2 is the mechanism we use to restrict a curator key to a fixed set of calls. Under that configuration the key becomes the sole member of a role permitted to make exactly these calls:
| Call | Constraint |
|---|---|
USDC.approve(spender, amount) | Spender pinned to the canonical core deposit wallet |
CoreDepositWallet.deposit(amount, dex) | Target pinned, destination dex pinned to spot |
CoreWriter.sendRawAction(spotSend(...)) | Destination pinned to the Safe, token pinned to USDC |
CoreWriter.sendRawAction(addApiWallet(...)) | API wallet address pinned |
settleDeposit / settleRedeem | On the vault |
The pinning uses bitmask conditions on the raw action bytes, which are the security boundary: five conditions pin the version byte, the action id, the destination address and the token id. Before a role is applied onchain, a sample payload is decoded byte by byte and each masked region compared against the definition, and a ten-case suite then exercises the deployed role, including cases that must revert.
A flaw in Zodiac Roles Modifier v2.1.0 was disclosed in June 2026 and patched in the audited v2.1.1.
Operational security
Admin authority, meaning role reassignment and fee changes, is held on a Ledger and is not used day to day. Fee changes are additionally delayed 24 hours onchain.
Vault-level protections are covered separately on Vault Protections.
Reporting a vulnerability
Write to contact@etesiar.com. Please do not open a public issue. There is no bug bounty and no published disclosure policy or response-time commitment.