Security
What has been checked, and what you still carry.
This page states what AutoLayer has published about audits, contracts and wallet practice, with dates, and where the risks remain with you.
Audits
Audited by PeckShield. Further audits scheduled.
AutoLayer was formerly Tortle Ninja. The Tortle Ninja contracts were audited by PeckShield, and the report is public.
New AutoLayer contracts go through audit as they ship, with further audits on the schedule. Reports are published on this page when they are final.
Read the PeckShield report (PDF)
That report covers the Tortle Ninja v1.0 code. It is not an audit of AutoLayer V2 or of any contract deployed after it.
On-chain
Verify it yourself.
- Security incidents
- None reported by the team. This is a point-in-time statement, not a continuing guarantee.
- Deployment
- Arbitrum only. The product has been live on Arbitrum since August 2023 under the Tortle Ninja name.
Wallets and incentives
Team wallets do not count.
-
The team agreed to remove team-controlled wallets from all milestone metrics and exclude them from incentives.
-
Funding for the proposed Arbitrum incentive program would sit in an institutional-grade, physically secured multisig wallet. In that program the multisig can halt the funding stream.
-
Wallets tied to transactions with the Arbitrum DAO or its members would be blacklisted from incentives, points and tokens. Suspicious wallets are excluded, and no wallet may take more than 1% of incentives.
Roadmap
Slashing protection is on the roadmap.
The V2 roadmap describes a bounty contract that would halt validation of an AVS before a slashing event reaches stakers.
Risks
Restaking carries real risk.
Nothing on this site is financial advice. Only commit what you can afford to lose.
Smart contract risk
Audits reduce risk but do not remove it. A bug in AutoLayer, in an integrated protocol or in an LRT issuer's contracts could lead to loss of funds.
Depeg and liquidation cascade
LRTs can serve as collateral for leveraged looping. AutoLayer's own roadmap notes that a sudden depeg could trigger automatic liquidations and leave bad debt in money markets.
Slashing
Restaked assets can be penalized if an AVS or operator breaks its rules. Slashing protection is on the V2 roadmap, not a live guarantee.
Oracle and pricing risk
Prices, routes and scores depend on external data and on liquidity at the time of your trade. Stale or manipulated data can produce bad outcomes.
Found a security issue?
Report it privately through the contact form with the topic Security disclosure. No paid bug bounty is published yet.