# Security Practices and Audits

> Spout's programs will be reviewed by independent security auditors. Each report will be published on this page with its date, scope and findings.

Canonical: https://spout.finance/docs/security-and-compliance/

---

## Audits

Spout's programs will be reviewed by independent security auditors. Each report will be published on this page with its date, scope and findings.

## How operations are kept safe

**No double actions**: Every onchain action the keeper takes is recorded, with its signature, before it is sent. If a service restarts, it checks whether the action landed instead of sending it again.

**No double sales**: Every liquidation order sent to the broker carries a unique key, so a retry cannot sell twice.

**Reconciliation**: Broker records and onchain records are compared continuously, including the shares held against the receipt tokens in each pool. Each options cycle moves to its next stage only when both agree.

**Halt, do not guess**: If a cycle or a liquidation cannot be reconciled, it halts, alerts the team, and waits for a person to resolve it. A halted cycle keeps its collateral locked so no calls are left uncovered.

**Prices are checked for tampering**: The price relay only carries prices signed by Stork; Stork's program checks the signature before a price is stored.

**Limited keys**: The operational key cannot change risk settings or fees, and governance caps how much premium it can record for any one contract.

## Program limits that protect users

| Limit | Protects against |
| --- | --- |
| 50% maximum LTV, enforced on every borrow and withdrawal | Loans opening too close to liquidation |
| Staleness checks on every price | Acting on old prices |
| 85% utilization cap | Lenders being unable to withdraw |
| Treasury bill rate capped at 6% a year | A wrong rate inflating lender balances |
| Contract lengths of 1 to 35 days accepted onchain | Mistaken contract records |
| Emergency shutdown keeps repaying open | Borrowers being unable to reduce their loans |

## Contract code

Spout's program addresses will be listed on this page, so anyone can inspect them onchain.