> For the complete documentation index, see [llms.txt](https://baseperp.gitbook.io/baseperp-whitepaper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://baseperp.gitbook.io/baseperp-whitepaper/token-and-safeguards/security-and-audits.md).

# Security & Audits

<figure><img src="https://3240446004-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FM0aAuCmI8Eff1Lw9tmMZ%2Fuploads%2FTrcDpTLOSNoslA3GEg39%2FSections_10.png?alt=media&amp;token=03280796-04f0-4a60-85e2-50d985e7346c" alt=""><figcaption></figcaption></figure>

Security at BasePerp is layered: rigorous code review, conservative operations, and on-chain safeguards that make failures rare—and contained when they happen.

### 10.1 Audit Plan & Bug Bounty

Before mainnet v1, the codebase undergoes multiple independent audits. Reviews focus on vault math, margin/liquidation logic, oracle guards, upgrade paths, and emergency controls. For any material change post-launch, a targeted re-audit is scheduled.

An always-on bug bounty invites external researchers under safe-harbor rules. Rewards scale with severity, and disclosure guidelines ensure fixes ship before public write-ups. Audit reports, issue trackers, and remediation notes are published for transparency.

### 10.2 Upgradeability & Timelocks

Upgrades are controlled and observable. Critical parameter and code updates pass through public timelocks with notice windows; where feasible, we prefer canary releases and minimal upgradeable surfaces to reduce blast radius. Emergency pausers are narrowly scoped and time-boxed, with mandatory post-mortems and diff links so the community can review actions.

A public parameter registry exposes current settings—including profitFeeRate, counterSkewCap, liquidatorBounty, deviationGuard, CHR thresholds, buffer tiers, and fee schedules—so integrators and users can verify live risk knobs on-chain.

### 10.3 Key Risks & Mitigations

Some failures are endemic to on-chain trading. We address them with explicit controls:

* **Oracle failure/latency**. Dual-feed validation with deviationGuard, heartbeat checks, and automatic halts on stale/out-of-band prices.
* **Jump risk & cascades**. Partial liquidations, short volatility halts, and buffer-tier withdrawals to slow feedback loops and preserve solvency.
* **Smart-contract bugs**. Multi-audits, formal/edge-case checks on critical math, heavy fuzzing, invariant tests, and bounty incentives.
* Keeper centralization. A permissionless keeper set with transparent rewards to promote diversity and reduce single-operator dependence.