Security & Audits
Last updated
Last updated
BadgerDAO has one of the most security minded teams in DeFi and has pioneered several practices to minimize risk.
Despite these efforts, using decentralized finance applications – including BadgerDAO – involves risk to your funds.
As a user, interacting with BadgerDAO products is your decision to make after considering your financial position, risk tolerance, and outlook on the various crypto assets involved.
Prior to depositing any funds, we strongly recommend reading this article to better understand the risks of using BadgerDAO, our security strategy, and your options for insurance coverage on your deposits.
BadgerDAO has developed a five-part strategy to ensure the security of user funds.The pillars of BadgerDAO's security strategy are:
Audits. BadgerDAO’s smart contracts are regularly audited by top security firms to discover and fix vulnerabilities before launch. Audit reports are linked below. Please note that audit reports cover specific portions of the BadgerDAO codebase and are done at a snapshot in time. Our code is frequently updated, which could introduce new vulnerabilities.
Guarded Launch. BadgerDAO was among the first in DeFi to use a guarded launch strategy where new Vaults are capped at a low ceiling for an initial testing period. This allows any bugs to be found and fixed before Vaults are opened to the general public.
Council of White Hats. BadgerDAO works with a team of expert white hat security researchers on a daily basis to review our systems and respond in real time to any vulnerabilities that are discovered.
Bug Bounties. BadgerDAO maintains bug bounty programs through and that pay up to $750,000 for the discovery of critical vulnerabilities. This is one of the most generous bug bounties in DeFi and creates a powerful incentive for bugs to be reported, not exploited.
Insurance. Nexus Mutual is a DeFi insurance protocol that allows users to purchase contracts that pay out if funds are lost due to certain types of smart contract exploit. The cost of is currently 2.6%, among the lowest in DeFi, which reflects a favorable appraisal of BadgerDAO’s security practices. BadgerDAO’s integration with Nexus Mutual gives users the option to buy an additional layer of safety for their crypto assets within the BadgerDAO ecosystem.
Earning yield with BadgerDAO requires interacting with smart contracts, which can sometimes fail or be prone to attacks. If there's a bug in the code, bad actors may take advantage, leading to a loss of funds.
To reduce this risk, audits are carried out by third parties retained by BadgerDAO and independent security researchers. During audits, experienced software developers review our smart contract code to identify potential security vulnerabilities before launch.
Security audits don’t completely eliminate risk; they simply do a thorough analysis of the code in order to correct design issues, errors and vulnerabilities. Like all work done by humans, problems can be missed.
To add an additional layer of security, BadgerDAO has deployed one of the biggest bug bounty programs in DeFi. This program incentivizes actors to act in a positive manner by offering them a generous reward in return for disclosing any unfound bugs within the smart contracts.
Audits do not eliminate risk, and attacks can still happen resulting in loss of user funds.
The Dev Multisig address maintains contract upgradability rights, can set key parameters to all products, controls the treasury, and manages all permissions.
To reduce the probability of the Dev Multisig address being exploited, 3 out of 5 signers are required to sign a transaction. In addition there is a 48-hour timelock for all key vault system governance and upgrability functions.
Some Vaults require users to deposit Liquidity Provider (LP) tokens to receive rewards. LP tokens are obtained by depositing equal value amounts of two crypto assets into a smart contract that allows other users to swap between assets in the pair. Providing liquidity exposes users to loss when the two assets diverge in price. Users can suffer losses if the rewards paid for providing liquidity do not compensate for the impermanent loss caused by asset price divergence.
BadgerDAO, as outlined in , is in a process of moving towards a completely decentralized autonomous organization. This includes multiple changes, especially to team addresses. As those are implemented this page will be updated.
Some yield-earning strategies within use smart contracts from third party platforms. Each strategy has a unique risk profile depending on what contracts and tokens it interacts with. To minimize this, Badger DAO only seeks out trusted DeFi platforms with a strong reputation in order to ensure the safety of user funds.
Crypto assets deposited into Vaults, Badger native assets (eg. and ), and issued as rewards to BadgerDAO users (eg. xSUSHI and CVX) are volatile and subject to market fluctuations. Assets that attempt to maintain a 1:1 peg with other assets (eg. DIGG to BTC or ibBTC to BTC) may fail to achieve their peg due to market conditions or smart contract failure.