Security is a design property
This page documents how Multyr is designed to be robust, what testing it undergoes, and where its external reviews stand.
Non-custodial by construction
Deposits convert to ERC-4626 shares. The protocol never holds user funds off-chain.
Separation of powers
ROOT_TIMELOCK, SAFE_GOV, SAFE_GUARDIAN, and SAFE_VETO split propose, execute, cancel, and pause authority.
Timelock-gated changes
All parameter changes pass through a 48h delay so users have visibility before execution.
Isolated strategies
Strategy Vaults are scoped so a failure in one does not automatically cross-contaminate another.
Exit paths preserved
Instant, queued, and force-withdrawal mechanisms are designed to preserve exit even in degraded states.
Internal testing
- Unit tests
- Fuzz testing
- Invariant testing
- Fork tests against live Arbitrum state
- Continuous shadow testing with controlled capital
External review
External review runs on two tracks. The MTRY / preMTRY token audit is complete: HackenProof, August 2026, all findings remediated. The full report is published ↗. The Core & Strategy audit is planned ahead of public launch.
A public bug bounty is planned on Immunefi ahead of public launch, following the protocol core audit.
Responsible disclosure contact: security@multyr.fi