Security & Audits
Security is central to Sova’s design. Each layer of the Sova Stack—chain, contracts, and vault infrastructure—undergoes targeted external review and inherits the assurances of the audited frameworks it extends.
Completed External Audits
Component
Auditor / Report
Scope
Status
Sova Chain
Execution client (sova-reth), consensus hooks, and bridging logic between Inspector ↔ Sentinel ↔ Bitcoin Core.
✅ Completed — All findings resolved prior to public testnet.
SovaBTC Contracts
ERC-20 upgradeable implementation of sovaBTC, mint/burn flow, and vault integration.
✅ Completed — No critical / high issues outstanding.
Upstream Reth Client
Core EVM execution, consensus engine, networking, and storage.
✅ Reth is actively maintained by Paradigm and audited annually.
OP Stack Node (op-node)
Framework by OP Labs (see blog post)
Sequencing logic, rollup coordination, and bridge contracts. Sova inherits security guidelines from OP Labs’ External Audit Framework.
🟢 Audited continuously via OP Stack governance and community competitions.
Upstream Inheritance
Sova builds directly on Reth (the 2nd largest Ethereum client by usage) and the OP Stack:
Reth Execution Layer: provides the baseline EVM implementation and core network safety properties.
OP Stack Consensus Layer: provides a battle-tested rollup node architecture and an established audit pipeline.
Sova Enhancements: integrate Bitcoin validation, Inspector finality logic, and Sentinel slot locking without altering core EVM security invariants.
Because Reth and OP Stack are open source and continuously reviewed, Sova inherits the collective security maturity of both ecosystems.
Audit Philosophy
Sova follows the OP Labs audit rubric (Existential vs Reputational × Liveness vs Safety):
Category
Examples
Audit Approach
Existential / Safety-Critical
Smart contracts securing assets (sovaBTC, vaults)
✅ Mandatory external audit + bug bounty program.
Reputational / Safety-Critical
Execution client (sova-reth, Inspector, Sentinel)
✅ Targeted audit + testnet validation + continuous monitoring.
Existential / Liveness-Critical
Bridge / Sequencer coordination
✅ OP Stack audit coverage + additional chaos testing.
Infrastructure / Liveness-Focused
Indexers, explorers, RPC gateways
⚙️ Hardening through open-testing and operational redundancy.
Key Principle: Security starts with the developers. Audits validate our assumptions—they don’t replace them.
Audit Preparation and Process
Before any external review, each subsystem team documents:
Invariants & Security Properties — what must never break.
Threat Model — how attacks could occur across the EVM ↔ Bitcoin boundary.
Testing Coverage — unit, integration, property-based, and fuzz tests.
Known Low-Risk Issues — explicitly marked as out of scope for auditors.
We target > 100 % coverage of critical code paths and perform additional “property coverage” reviews to ensure each security property is tested qualitatively.
Continuous Security Measures
Bug Bounties: Planned public bounty program on Sherlock / Immunefi (Q1 2026).
Formal Verification: Selective application to vault math and lock reversion logic.
Network Monitoring: Automated Sentinel alerts for anomalous slot behavior and Bitcoin anchor divergence.
Incident Response: Governance-controlled multi-sig for emergency pausing of mint/burn paths.
Upgrade Controls: All upgrades through
UpgradeManager.solwith timelocks and on-chain events.
Reporting & Transparency
All audits and security updates are published publicly:
Artifact
Location
Audit Reports
Security Advisories
security.sova.io (coming soon)
Responsible Disclosure
Summary
Independent audits by Zokyo and Milo confirm the security of Sova’s chain and contracts.
Upstream dependencies (Reth and OP Stack) have their own public audit programs and continuous community review.
Sova’s security philosophy is proactive, developer-driven, and transparent — every release is validated through testing, audit, and real-world usage.
Learn more: Read the Zokyo Chain Audit Report and the Milo Contracts Audit.
Last updated