> For the complete documentation index, see [llms.txt](https://docs.aspanfi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aspanfi.com/risk-management/smart-contract-security.md).

# Smart Contract Security

Security claims must identify the code and deployment they cover. Native ASPAN DeFi, the planned programmable account and payment layer, and new external-strategy Vaults have different scopes.

### Initial DeFi audit report

[Adevar Labs — Initial Audit Report (19 March 2026)](https://github.com/AdevarLabs/audit-reports/blob/main/reports/2026-03-19_Aspan_Finance_audit_report.pdf)

This initial report covers only the existing DeFi components. It does not cover the payment layer, new account and AI execution controls, or planned ASPAN Vaults.

* **Repository:** Ysquared-Labs/aspan-sc.
* **Reported source scope:** src/\*\*/\*.sol.
* **Audit-fix reference:** 5f7ae6653f162a032f18772b5f6bfa87e84d86f4.

The report does not establish that a current deployed contract, proxy implementation, configuration, or later change is covered. Production alignment and subsequent changes require verification.

### Account and payment scope

Spending and investment permissions, policy enforcement, owner approvals, revocation, liquid-balance accounting, and AI execution remain part of the new account's implementation and review work.

Conditional, streaming, escrow, and split payment flows in the current prototype are simulations. Production contracts, condition verification, dispute rules, and provider adapters require their own review. Sample balances and simulated approvals are not evidence of safe real-fund settlement.

### External-strategy Vault scope

New Vault contracts, share accounting, valuation, adapters, withdrawals, and strategy permissions require review specific to their implementation. An audit of a connected protocol would not automatically cover ASPAN's adapter or account integration.

The existing native DeFi audit does not certify these planned Vaults or the AI manager's investment performance.

### Before a real-fund release

* Identify deployed contracts, configuration, signing dependencies, and the exact reviewed source.
* Review subsequent changes and publish the applicable audit and deployment references.
* Test authorization, limits, approvals, revocation, settlement, cancellation, refunds, and failure handling.
* Verify valuations, available reserves, withdrawal timing, and actual exit assets for each admitted strategy.
* Independently review new account, payment, Vault, and adapter components before their use with real funds.

No universal timelock duration, production contract address, or completed payment or Vault audit is asserted here. Those details belong to a verified release record.