Security

Security architecture and practices

Security is foundational to Sova Protocol. This document covers the security architecture, operational practices, and vulnerability reporting procedures.

---

Security Architecture

Sova implements defense-in-depth with multiple security layers:

Layer 1: Smart Contract Security

Standard	Purpose
ERC-4626	Battle-tested tokenized vault standard
OpenZeppelin	Audited base contracts for access control and proxies
ERC-20	Standard token implementation for svBTC

Layer 2: Access Control

• Role-Based Permissions — Granular access via Role Manager contract
• Multi-Signature — Critical operations require multiple approvals
• Rate Limiting — Protection against rapid successive operations

Layer 3: Monitoring

• On-Chain Watchers — Real-time transaction monitoring
• Alert Systems — Automated notifications for anomalies
• Balance Tracking — Continuous verification of contract states

---

Upgrade Pattern

Sova uses the transparent proxy pattern for contract upgrades:

Architecture

Component	Function
Proxy Contract	Holds storage, delegates calls to logic
Logic Contract	Contains business logic, upgradeable
Storage	Preserved across upgrades

Benefits

• Security Patches — Deploy fixes without user migration
• Feature Updates — Add functionality preserving state
• Storage Safety — User balances persist through upgrades

Safeguards

• All upgrades require multi-sig approval (2/3+ signers)
• Time-locks for non-emergency upgrades
• Upgrade events logged on-chain for transparency

---

Access Control

Role-Based Permissions

Role	Permissions	Assignment
ADMIN	Full control, upgrades, emergency pause	Multi-sig (2/3+)
REPORTER	Update NAV, price feeds	Oracle system
OPERATOR	Day-to-day operations, process withdrawals	Operational team

Multi-Signature Requirements

Operation	Requirement
Contract upgrade	2/3 signers
Emergency pause	1/3 signers (fast response)
Parameter changes	2/3 signers
Fund recovery	3/3 signers

---

Transaction Safety

Slippage Protection

All swaps include default 1% slippage tolerance:

• Quote shows expected output
• Transaction reverts if output falls below minimum
• Adjustable in advanced settings

Quote Expiration

Quote Type	Validity
Swap quotes	5 minutes
Limit order quotes	At order creation
NAV data	5 minute refresh

Address Validation

All destination addresses validated before execution:

Bitcoin:

• P2WPKH (SegWit): bc1q...
• P2TR (Taproot): bc1p...
• P2PKH (Legacy): 1...
• P2SH: 3...

Zcash:

• Transparent: t1...
• Shielded: Not supported (zs...)

Checksum validation performed on all addresses before transaction submission.

---

Monitoring & Incident Response

Real-Time Monitoring

• On-chain watchers for unusual activity
• Balance tracking across all contracts
• Transaction monitoring for failed operations
• Price feed validation for oracle data

Incident Response

Severity	Response Time	Actions
Critical	< 15 minutes	Emergency pause, all hands response
High	< 1 hour	Assessment, patch deployment, user communication
Medium	< 24 hours	Scheduled fix, close monitoring
Low	Next release	Track in backlog

---

Non-Custodial Design

Sova never has access to:

• Private keys
• Seed phrases
• Wallet passwords
• Personal information
• KYC data

On-Chain Transparency

All operations verifiable:

• Deposits to vault contracts
• Swaps via smart contracts
• Limit order execution
• All visible on BaseScan

---

Verified Contracts

All Sova contracts verified on BaseScan:

Contract	Verification
svBTC Token	View Source
Vault Strategy	View Source
Conduit	View Source
Role Manager	View Source

---

Reporting Vulnerabilities

Found a security issue? Report directly to our security team.

Do NOT disclose publicly. Report directly via the channels below.

Contact

Email: [e-mail]

Include

• Description of the vulnerability
• Steps to reproduce
• Potential impact assessment
• Your contact information (for follow-up)

Response Timeline

Stage	Timeframe
Acknowledgment	Within 24 hours
Initial Assessment	Within 72 hours
Resolution Timeline	Provided after assessment

Bug Bounty

Coming soon. Follow @sovabtc for announcements.

---

Best Practices

For Users

1. Verify Contracts — Check addresses before interacting
2. Start Small — Test with small amounts first
3. Bookmark the App — Avoid phishing via direct navigation
4. Check Approvals — Revoke unused token approvals periodically
5. Secure Your Wallet — Use hardware wallet for large amounts
6. Double-Check Addresses — Especially for cross-chain destinations

Phishing Prevention

• Official URL: app.sova.io
• Never share private keys or seed phrases
• Be cautious of unsolicited DMs claiming to be support
• Official support only through documented channels