> For the complete documentation index, see [llms.txt](https://docs.fira.money/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fira.money/security-and-risk/security-overview.md).

# Security Overview

Fira treats security as a structural requirement. Before any user funds were accepted, Fira smart contracts underwent six independent external audits, an extended internal security review, and a live bug bounty program was established. Every deployed contract is verified on Etherscan.

## Audit Coverage

Six independent audits were conducted on Fira contracts between November 2025 and March 2026:

| Audit                | Auditor            | Date          | Type                    |
| -------------------- | ------------------ | ------------- | ----------------------- |
| Fira UZR Audit Nov25 | Sherlock           | November 2025 | Competitive audit       |
| Fira UZR Audit Nov25 | Spearbit / Cantina | November 2025 | Focused security review |
| Fira UZR Audit Dec25 | yAudit             | December 2025 | Independent assessment  |
| Fira V1 Audit Feb26  | Sherlock           | February 2026 | Competitive audit       |
| Fira V1 Audit Feb26  | Hexens             | February 2026 | Independent audit       |
| Fira V1 Audit Mar26  | yAudit             | March 2026    | Independent assessment  |

All findings were addressed before deployment. Full reports and methodology details are on the [Audits](/security-and-risk/audits.md) page.

In addition, the Steady Labs engineering team conducted an extended internal security review covering code quality, deployment procedures, parameter configurations, access controls, and operational security.

## Bug Bounty

Fira maintains a live bug bounty program through Sherlock with rewards up to **$500K** for critical vulnerabilities. The program covers all deployed Fira V1 contracts on Ethereum mainnet.

For the full scope, reward tiers, and submission process, see the [Bug Bounty](/security-and-risk/bug-bounty.md) page.

## Smart Contract Architecture

Fira's system is composed of three core modules:

* **Lending Market** — Core lending vault, collateral management, liquidations, interest accrual, and ERC-4626 curation vaults
* **Fixed-Rate AMM and Tokenization** — BT/CT/FW token system, fixed-rate price discovery AMM, and rehypothecation module
* **Router** — Diamond-style proxy dispatching to modular action contracts for single-transaction user flows

Access control is enforced through role-based permissions and multisig governance. For the full architecture, see [Architecture Overview](/protocol/architecture-overview.md).

## Risk Framework

Fira documents six primary risk categories:

1. [Interest Rate Risk](/security-and-risk/risk-framework/interest-rate-risk.md)
2. [Liquidation Risk](/security-and-risk/risk-framework/liquidation-risk.md)
3. [Bad Debt Risk](/security-and-risk/risk-framework/bad-debt-risk.md)
4. [Collateral Risk](/security-and-risk/risk-framework/collateral-risk.md)
5. [Liquidity Risk](/security-and-risk/risk-framework/liquidity-risk.md)
6. [Smart Contract Risk](/security-and-risk/risk-framework/smart-contract-risk.md)

For the full risk index, see [Risk Framework](/security-and-risk/risk-framework.md). For legal disclaimers, see [Risk Disclaimers](/security-and-risk/risk-disclaimers.md).

## Key Principle

Audits, reviews, and bounties reduce certain risks but do not eliminate them. Fira is experimental software. Users should understand all risk categories before interacting with the protocol.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fira.money/security-and-risk/security-overview.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.