Security & Audits

Alandale's contracts have been through several independent security reviews. Every report is published in the open — nothing here is a summary you have to take our word for.

📁 All audit reports →

Each review below also links to the auditor's own published copy, so you can check ours against theirs.

The ve(3,3) core

The locking, voting, gauge and emission contracts — VotingEscrow, Voter, Minter, the gauges and the bribe contracts.

Code4rena

Auditor	Code4rena (Invitational)
Dates	18 – 25 September 2024
Scope	984 lines of Solidity
Wardens	KupiaSec, Ch_301, nnez, K42
Judge	alcueca
Findings	1 High, 6 Medium, 3 Low / non-critical

Read the full report → · On code4rena.com · Every finding, issue by issue

Hats Finance

An open audit competition, with every issue fixed and each fix linked to the commit that made it.

Severity	Issue	Status
High	Adversary can steal all bribe rewards	Fixed
High	First liquidity provider of a stable pair can DOS the pool	Fixed
Medium	Protocol fees collected in PairFees lost to accrued yield	Fixed
Low	GaugeFactoryUpgradeable.setDistribution() reverts on incorrect access control	Fixed
Low	Missing events on functions that change critical parameters	Fixed

Read the fixes, with commits → · The audit repository

Concentrated liquidity

The CL engine is Algebra Integral, which carries its own audit history across five separate reviews.

Module	Auditor	Report
Core	MixBytes	Report
Farming	MixBytes	Report
Base plugin	MixBytes	Report
Entire protocol	Riley Holterhus	Report
Entire protocol	Paladin	Report

Verify it yourself

An audit is evidence, not a guarantee. The stronger check is the one you run:

• Read the code. Every contract is open source at Alandale-xyz/alandale-contracts.
• Check the addresses. The deployed addresses are listed on the Networks & Contracts page and are verified on the explorer, so you can read the live source of the exact contract you are about to sign for.
• Confirm what you're signing. Alandale is non-custodial and never asks for a seed phrase. The team will never DM you first.

Reporting a vulnerability

Found something? Please report it privately rather than publicly, so it can be fixed before it is exploited.

Reach the team through Discord or Telegram and ask for a maintainer — do not post details in a public channel.

Risk

Smart contracts carry risk, audited or not. Liquidity provision carries impermanent loss, concentrated positions carry more of it, and locking LUTE means giving up the ability to sell for the length of the lock. Only commit what you can afford to lose, and read the Disclaimer.