> For the complete documentation index, see [llms.txt](https://docs.usd8.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.usd8.ai/transparency/security-and-audits.md).

# Security & Audits

Audited by Hashlock, built on Ethena's battle-tested architecture, governed by a timelocked multisig with an independent guardian.

Security at USD8 is layered: audited code with a conservative pedigree, governance that cannot move fast even if it wanted to, and emergency brakes held by an independent guardian.

## Audit

<img src="https://3023945580-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FF2kfqWMLPWObs0FDO0Dd%2Fuploads%2Fgit-blob-f04977e2739b1a25ac4a264c86430ac5d95646e2%2Fhashlock-logo.webp?alt=media" alt="Hashlock" data-size="line"> **The USD8 contracts have been audited by** [**Hashlock**](https://hashlock.com) — final report published September 2026, with all findings remediated before the production deployment. Hashlock's overall assessment places the audited USD8 contracts in its **Secure** band.

<figure><img src="https://3023945580-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FF2kfqWMLPWObs0FDO0Dd%2Fuploads%2Fgit-blob-e7397fe21624a1549dc11560da5aafafad13d481%2Fhashlock-report-cover.webp?alt=media" alt="USD8 Smart Contract Audit Report — Hashlock, final report" width="320"><figcaption><p>USD8 Smart Contract Audit Report — Hashlock, September 2026</p></figcaption></figure>

{% hint style="success" %}
[**Read the full audit report (PDF) ↗**](https://assets.usd8.ai/audits/usd8-smart-contract-audit-hashlock-2026-09.pdf) — opens directly in your browser.
{% endhint %}

Hashlock covers the **contracts**. How the reserve portfolio is held, valued and reviewed is a separate process — see [How Reserves Are Managed](/transparency/how-reserves-are-managed.md).

## A conservative pedigree

USD8 does not reinvent core stablecoin machinery. The token and staking contracts are a **minimal-diff fork of Ethena's audited USDe / sUSDe architecture** (GPL-3.0) — one of the most battle-tested stablecoin codebases in the industry — with changes kept deliberately small so the upstream audit history retains its value. The protocol-specific layers (mint vault, rewards distributor, term locker) are purpose-built and covered by the Hashlock audit.

Everything is built on open standards: **ERC-20** (USD8), **ERC-4626** (sUSD8), **ERC-721** (term certificates), **EIP-2612** permits — no wrappers, no proprietary interfaces.

## Governance

* **Timelocked multisig.** Administrative changes to the protocol go through a multisig behind an on-chain timelock — parameter changes are visible on-chain before they take effect.
* **Two-person yield distribution.** Daily yield requires one authorized signer to propose and a *different* signer to approve; self-approval is rejected by the contract. Proposals expire after 24 hours and either party can veto.
* **Daily mint circuit breaker.** The distributor caps each day's yield mint at a small fraction of vault assets, hard-coded on-chain.
* **Zero backend keys.** The protocol's backend services hold no private keys and cannot sign transactions — all value movement is user wallets or the governance process above.

## Emergency brakes

| Brake                  | Holder                | Effect                                                                             |
| ---------------------- | --------------------- | ---------------------------------------------------------------------------------- |
| Pause mint / redeem    | Independent guardian  | Instant stop of new deposits and redemption requests; resuming requires governance |
| Peg circuit breaker    | Anyone                | Oracle deviation from $1 lets any wallet trigger an automatic pause                |
| Pause staking deposits | Guardian / governance | Stops new stakes — **withdrawals are intentionally unpausable**                    |
| Pause new locks        | Governance            | Stops new lock positions; maturities and claims unaffected                         |

{% hint style="success" %}
**The exit is never locked.** Unstaking from sUSD8 cannot be paused by any key — including the protocol's own. Escrowed redemptions can always be cancelled back to USD8.
{% endhint %}

## Compliance capability

Like other major stablecoins, USD8 implements an address-freeze capability restricted to a dedicated compliance role, for responding to sanctioned or illicit-activity addresses. It cannot touch balances of ordinary users and every freeze action is a public on-chain event.