Audited by Valves Security
Valves Security is one of the top security firms in the industry. We have also been audited by multiple independent researchers and white hat groups, with more third-party audits to come.
Visit Valves SecuritySecurity
Transparency about how we protect your funds
Comprehensive Security Audit Complete
Latest audit: Valves Security, July 30, 2026
🏗️ Architectural Security
MaxFi's architecture eliminates entire classes of DeFi attacks by design, not just by adding guards.
Zero-Swap Design
No token swaps during rebalances. This eliminates MEV extraction, sandwich attacks, and slippage — the most costly vulnerability class in DeFi ($1.2B+ in 2024 alone).
Per-User NFT Positions
Each user owns their own concentrated liquidity NFT. No shared pool, no exchange rate to manipulate. Eliminates the entire class of ERC-4626 vault attacks (inflation, donation, rounding).
TWAP Hard Revert
The protocol NEVER falls back to manipulable spot prices. Unlike protocols that caused $52M+ in oracle manipulation losses in 2024, MaxFi reverts on TWAP failure.
🧪 Testing Methodology
Our smart contracts undergo rigorous multi-layered testing to ensure reliability and security.
Unit & Fork Tests
Comprehensive test coverage for all contract functions and edge cases
Invariant Tests
Property-based tests verifying critical security properties hold under any operation sequence
Randomized Calls
Invariant tests execute ~40,000 randomized function calls to find edge cases
Invariants Verified
🛡️ Exploit Resistance
Verified against known DeFi attack vectors from 2024-2026 ($2B+ in losses analyzed).
🔍 About Our Security Audits
Our smart contracts have undergone 40+ audit iterations using industry-standard methodologies including OWASP Smart Contract Top 10 (2026), EEA EthTrust Security Levels V3 (88 requirements), SWC Registry (SWC-100 through SWC-136), and analysis of 15+ major DeFi exploits from 2024-2026 totaling $2B+ in losses.
The methodology is informed by Trail of Bits, OpenZeppelin, Cyfrin, and Spearbit audit frameworks. All 23 Solidity files (~6,700 lines) have been reviewed line-by-line across multiple iterations with progressive remediation of all identified issues.
Transparency Note: Internal review came first: 40+ audit iterations against the standards above, before any outside auditor saw the code. Valves Security then reviewed it independently, as have multiple independent researchers and white hat groups. Further third-party audits are in progress. Always do your own research and only deposit what you can afford to lose.
Security Features Implemented
Zero-Swap Design
No token swaps during rebalances — eliminates MEV, sandwich attacks, and slippage
Per-User NFT Positions
Each user owns their own LP NFT — no shared vault, no inflation attacks
TWAP Oracle (Hard Revert)
5-minute TWAP with no spot price fallback — prevents oracle manipulation
ReentrancyGuard
All state-changing functions protected against reentrancy attacks
Ownable2Step
Two-step ownership transfer prevents accidental lockout across all contracts
Fee Rate Limiting
Fees can only change ±5% per 6 hours — 42 hours minimum to reach max
24h Timelocks
Treasury and staking manager changes require 24-hour timelock
Pausable
Emergency stop capability for incident response
SafeERC20
Safe token transfer patterns for all ERC20 operations
Flash Loan Protection
1-minute minimum hold time prevents flash loan exploits
Position Limits
Configurable limits prevent gas griefing (500/user, 100K total)
Read-Only Reentrancy Protection
Withdrawal flags in reward adapters prevent view function exploits
Audit Reports
Valves Security — Independent Security Review
July 30, 2026
External audit of the vault contracts by Valves Security.
V41 Full Security Re-Audit
July 22, 2026
Robinhood Chain port. No new Critical, High or Medium findings.
V37 Internal Keeper Audit
July 22, 2026
Keeper and automation layer.
V31 Post-Valves Internal Audit
July 21, 2026
Review of the code changed while remediating the Valves findings.
V30 Comprehensive Security Audit
February 16, 2026
Full protocol review.
🐛 Report a Security Issue
Found a vulnerability? We take security seriously and appreciate responsible disclosure. Reach out to us through any of these channels:
Future Security Plans
- ○Ongoing third-party audits as the protocol grows
- ○Launch formal bug bounty program with rewards
- ○Add multi-sig requirement for protocol upgrades
Important: Despite our security measures, all DeFi protocols carry inherent risks. Smart contract bugs, economic exploits, and unforeseen vulnerabilities can result in loss of funds. Never deposit more than you can afford to lose. Please read our full risk disclosure before using MaxFi.