Security Overview

Security is foundational to the YoorQuezt MEV platform. This document covers smart contract security patterns, audit status, infrastructure security layers, testing coverage, and the roadmap for external audits and formal verification.

Smart Contract Security Patterns

All settlement contracts implement industry-standard security patterns:

Deployed Contracts

Mainnet deployment of settlement contracts is pending external audit completion.

Audit Status

Internal Audit (March 2026)

All 8 HIGH findings were resolved internally:

1. Missing reentrancy guard on claimPayout -- added nonReentrant modifier
2. Unchecked return value on ERC20 transfer -- switched to SafeERC20
3. Missing zero-address check on solver registration -- added validation
4. Potential front-running on sealed-bid reveal -- implemented commit-reveal scheme
5. Missing pause checks on critical functions -- added whenNotPaused
6. Integer overflow in fee calculation -- covered by Solidity 0.8+ built-in checks
7. Missing event emissions on state changes -- added events for all mutations
8. Stale epoch data not cleaned up -- added recoverExpired function

External Audit

External audit is deferred pending funding ($10-25K estimated cost). The RFP is prepared at docs/audit-rfp.md.

Scope:

• AuctionSettlement.sol (~350 LOC)
• RebateDistributor.sol (~280 LOC)
• IntentRegistry.sol (~320 LOC)
• Deploy scripts and configuration

Settlement Security Model

The settlement layer uses a sealed-bid auction model:

1. Deposit -- searchers deposit ETH as bidding collateral into AuctionSettlement.
2. Commit -- bids are committed as hashes (commit-reveal prevents front-running).
3. Reveal -- bids are revealed and validated against commitments.
4. Settle -- winner is determined, funds are transferred, protocol fee is locked per-auction.
5. Claim -- winner claims payout via pull pattern (no automatic push distribution).

Security properties:

• Bids are hidden until reveal phase (sealed-bid).
• Deposits are locked until settlement or withdrawal window.
• Protocol fees are capped (MAX_FEE_BPS = 2000, i.e., 20%) and locked at settlement time.
• Emergency pause halts all operations.
• Two-step ownership prevents accidental admin transfer.

Infrastructure Security

Audit Trail

Every MEV capture and rebate payout is recorded in a tamper-evident audit log:

• SHA256 proof hashes for all settlements
• On-chain events for all state changes
• Originators can verify rebates via /v1/ofa/audit/verify endpoint
• Bundle lifecycle logging (submitted, simulated, landed, failed)
• Solver registration, matching, and slashing events
• Configuration changes and emergency pause/unpause events

Testing Coverage

Test methodologies:

• Unit tests -- counterfeiter fakes for interfaces, table-driven subtests
• Smoke tests -- lightweight validation without external dependencies
• Integration tests -- httptest servers, testcontainers (Docker)
• E2E tests -- Docker containers with real services, testnet connectors with live chains
• Race detection -- go test -race on all Go packages
• Fuzz testing -- Foundry fuzz on contract boundary conditions

External Audit Timeline

Security Roadmap

Responsible Disclosure

If you discover a security vulnerability, please report it responsibly:

• Email: security@yoorquezt.io
• Do not disclose publicly until a fix is deployed.
• Include reproduction steps and impact assessment.
• We aim to respond within 48 hours and resolve critical issues within 7 days.

Bug Bounty (Planned Q3 2026)

Scope will include smart contracts, API endpoints, and P2P protocol. Program hosted on Immunefi.