> For the complete documentation index, see [llms.txt](https://docs.tydro.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tydro.com/v.-risk/risk-types-and-overview/smart-contract-risk.md). # Smart Contract Risk ## Smart contract risk Tydro is software. Software can contain errors, and the powers that govern it can be misused. This page describes the risk in the protocol's code and control surface. ### Code can fail Tydro is built on the Aave V3 codebase, which is widely deployed and has been audited and used at scale. That history lowers the odds of an undiscovered flaw in the core lending logic, though it cannot drive them to zero. No audit or track record proves code is free of bugs, and a flaw that has not surfaced is still a flaw. Tydro also adds its own surface area on top of that base. Configuration, oracle integration, custody connections, tranching, and vaults are all places where errors can be introduced, and they have not accumulated the same history as the underlying engine. A failure in any of them can lead to loss of funds. Known attack classes include flash loan exploits, oracle price manipulation, and reentrancy. The protocol is designed to defend against these, but no design eliminates the risk entirely. {% hint style="warning" %} A smart contract exploit or critical bug can result in the partial or total loss of assets held in the protocol, with no guarantee of full recovery. **Umbrella provides a first layer of coverage against shortfalls, but does not guarantee complete restitution. See** [**Umbrella**](/viii.-resources/umbrella.md)**.** {% endhint %} ### Upgrade powers carry their own risk Tydro markets are mutable. Governance can change parameters and upgrade contracts. This is useful for managing risk, and it is also a risk in itself. If an upgrade key is compromised, or an upgrade is made in error, the behavior of the protocol can change in ways that harm users. Tydro scopes these powers and separates them across roles to limit that exposure, but the powers exist. Where a component is immutable, the opposite applies. It cannot be changed by a compromised key, and it also cannot be fixed if a flaw is found in it. ### What an audit can and cannot tell Audits and reviews are one input to security. An audit reflects a defined scope and a point in time. It can miss issues, and it does not cover changes made afterward. Treat a completed audit as evidence of the diligence applied, not as proof that funds are safe. **On Aave V3 audits:** Tydro's core lending logic is the Aave V3 codebase. The Aave V3 audit set is directly relevant to that base layer and is linked from the Audit reports page. Those audits cover the base codebase, not Tydro's additions. Tydro-specific components, including configuration, oracles, tranching, and vaults, require their own audits, which are listed separately. See [Audit Reports](/vi.-security/audit-reports.md). ### Bug bounty and incident response Details to come. ### Dependencies and integrations Tydro relies on external systems, including price feeds, the Ink network and its bridge, and the custody integration. A failure in any dependency can affect the protocol even when Tydro's own code is sound. See [Price Feed Risk](/v.-risk/risk-types-and-overview/price-feed-risk.md) and Custody and counterparty risk. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.tydro.com/v.-risk/risk-types-and-overview/smart-contract-risk.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.