Security is a design property
This page documents how Multyr is designed to be robust, what testing it undergoes, and where its external reviews stand.
Non-custodial by construction
Deposits convert to ERC-4626 shares. The protocol never holds user funds off-chain.
Separation of powers
SAFE_GOV changes parameters, SAFE_VETO can revoke a pending vault change, and SAFE_GUARDIAN can pause: three separate Safes.
Multisig governance
Parameter changes are made by SAFE_GOV, a 3-of-5 Safe, after the vault's minimum delay, which can be 0. Every change is an on-chain transaction, visible once executed.
Isolated strategies
Strategy Vaults are scoped so a failure in one does not automatically cross-contaminate another.
Exit paths preserved
Instant, queued, and force-withdrawal mechanisms are designed to preserve exit even in degraded states.
Internal testing
- Unit tests
- Fuzz testing
- Invariant testing
- Fork tests against live Arbitrum state
- Continuous shadow testing with controlled capital
External review
External review runs on two tracks. The MTRY / preMTRY token audit is complete: HackenProof, August 2026, all findings remediated. The full report is published ↗. The Core & Strategy audit is planned ahead of public launch.
A public bug bounty is planned on Immunefi ahead of public launch, following the protocol core audit.
Responsible disclosure contact: security@multyr.fi