Protected floor
Your existing reward balance becomes a floor. Compounding only uses eligible tokens above it, within the allowance you approve.
Security & Controls
Defense in depth: on-chain limits you sign, guarded execution, and an engineering record that says exactly what has and has not been verified.
View verification recordBug bountySoon
103Application tests
364Protocol tests
0Live executions until verified
Verified in-house
Every release is checked against the recorded scopes below before anything can execute. These are our own engineering checks, not an independent audit, and the page says so on purpose.
| Scope | Coverage | Method | Date | Record |
|---|---|---|---|---|
| Permission & accounting | Protected floor, bounded allowance, expiry, owner rate, actual output, replay protection, revocation | Local SBF tests | Sep 2026 | View record |
| Price protection | Immature and stale history, substituted sources, spot deviation, minimum-output bypass, atomic rollback | Local guard tests | Sep 2026 | View record |
| Lending protocol | 364 native protocol tests, 67 SVM tests, all 58 instructions with a compute baseline | Local + SVM | Sep 2026 | View record |
| Hosted operations | Journal durability, ambiguous submissions, request limits, read-only readiness monitoring | Local + hosted checks | Sep 2026 | View record |
Find bugs. Get rewarded. Coming soon
Rewards will be assessed by severity and potential impact on user funds. Send reproducible reports; critical findings are handled through coordinated disclosure.
What’s in scope
- Program logic and state handling
- Price guard and minimum-output enforcement
- Delegation and allowance boundaries
- Frontend flows that affect funds
What you control
The permission model is the product. Every limit below is enforced by the program and changed only with your signature.
One defined purpose
Connecting approves no spending. The executor's reward-token permission is limited to buying the selected coin and delivering it to your wallet.
Checked outcomes
The executor checks the reward floor, price bounds and net output. If a required check fails, the swap and accounting revert together.
You end it
Stop compounding in your position or revoke the delegation from your wallet. After confirmation, ANVIL cannot spend through that permission.
Our commitment to researchers
Safe harbor
Good-faith researchers who report responsibly will not face legal action.
Response timeline
Initial response within 24 hours and updates until the report is closed.
Coordinated disclosure
We agree a disclosure timeline that protects users before details are published.
Found something?
If you discovered a potential vulnerability, we want to hear from you.
Disclosure channelAt launchWhat these controls do not remove
- Token prices can fall, payouts can stop, and taxes or trading costs reduce what you receive.
- Issuer freeze, pause or recovery controls still apply. Some token extensions are unsupported.
- Sampled pool prices can be thin or manipulated; the checks reduce that risk but are not manipulation-proof.
- Software can contain bugs. An upgradeable deployment carries authority risk; inspect its actual authority and bytecode.