Security
No admin keys. One key that can only close, and it expires.
Review status
No audit has been completed. This is not a formality we are about to clear.
At the time of writing there is no completed audit of the Fyber contracts, no audit in progress, and no bug bounty programme open. We put that at the top of the security page instead of at the bottom of a disclosures file, because it is the single most useful thing this page can tell you today.
Nothing on this site carries an “Audited” badge. Where other protocols put one, Fyber puts “Immutable”, which is a claim about the code’s mutability and is verifiable on chain today.
| Item | Status |
|---|---|
| External audit | None completed, none in progress |
| Bug bounty | Not open |
| Invariant and fuzz suite | In development, to be published with the code |
| Testnet deployment | Not yet deployed |
| Mainnet deployment | Not yet deployed |
This table is updated when a line changes, and never softened in the meantime.
Immutability
What immutable means here, precisely.
Not “governance-minimised”. Not “progressively decentralised”. The bytecode cannot change.
Nothing can be corrected after deployment
No parameter can be changed once the contracts are live. An unanticipated corporate action, a spin-off for instance, can cause a definitive loss with no human safeguard in existence. A failing component causes the closure of its branch, not its repair.
No proxy
The contracts are deployed directly. There is no implementation address to repoint and no upgrade path to capture.
No setter
Every ratio, fee, cap and bonus is a compile-time constant or a pure function of measured on-chain state.
No timelock
A timelock delays a change. There is no change to delay, so there is nothing for a timelock to protect you from.
No admin role
No owner, no guardian with parameter powers, no multisig that can act on your position.
The Closer key
One key, three powers, one expiry date.
Held by the development company until day 365 after deployment. On that day it stops working, permanently, with no mechanism anywhere to renew it.
What it can do
Until day 365Freeze certain functions for at most 72 hours
A freeze halts borrowing and redemption on a branch while something is investigated. It expires by itself; there is no way to renew it, and it is bounded in the contract, not in a policy.
Irreversibly shut a branch down
A shutdown puts a branch into its terminal state: borrowers repay and withdraw, nothing else happens, and the branch never reopens. It is a one-way door with no undo.
Irreversibly shut the whole protocol down
The same door, applied to everything at once. Positions are repayable and collateral is withdrawable afterwards, permanently.
Renounce itself early
The holder can burn the key before its expiry date. That is the only way the timeline gets shorter, and it is public when it happens.
What it cannot do
Ever- Mint a single fyUSD.
- Change a rate, a ratio, a fee, a cap or any other parameter.
- Move, seize, lend out or repoint your collateral.
- Stop you repaying your debt, adding collateral or closing your position. Those functions are outside its reach in every state.
- Read or restrict a particular address.
- Extend its own life past day 365.
The key can destroy the protocol. It can never quietly change it, and it can never touch what you owe or what you hold.
One key exists, and it expires
Until day 365 after deployment, a key held by the development company may freeze certain functions for at most 72 hours, liquidations and open sales for at most 24 hours and never twice within seven days on the same branch, and may irreversibly close a branch or the whole protocol. New Stability Pool deposits are refused while a liquidation freeze runs; withdrawals are not. The key can neither mint, nor modify a parameter, nor block repayments and withdrawals. After that date no human intervention is possible at all.
The path out
Repaying is never paused. In any state, for any reason.
Every protocol says it is over-collateralized. The question that matters is what happens on the worst day, when the oracle is wrong, the freeze is on, and everyone wants out at once. Fyber answers it by putting three functions outside the reach of every control that exists.
Repay your debt
Available in LIVE, in DRIFT, in BLIND, during a freeze, and after a shutdown. It does not read the oracle, so an oracle failure cannot block it.
Add collateral
Always available. Improving your own position can never be refused, whatever the market is doing.
Close your position and withdraw
Once the debt is zero the collateral is yours to take, in every state the protocol can be in.
Questions
The uncomfortable ones.
Answered here, not in a support channel.
Has Fyber been audited?
No. No audit has been completed, and none is in progress at the time of writing. Any badge on this site says “Immutable”, never “Audited”, because the second would be false.
When audits happen, the reports will be published in full, including the findings that were disputed or accepted as residual risk, at the same address as the contracts. Until then, treat the code as unaudited, because it is.
Is there a bug bounty?
Not yet. A programme will open with the testnet deployment, scoped to the core contracts and funded from the deployment budget, not from a token. Until it exists, there is no reward pool to point you at, and saying otherwise would be an invitation to work for nothing.
If you find something now, the responsible thing is still to report it privately before the contracts hold anyone’s money. Scope and contact details are kept in the documentation and updated when the programme opens.
What happens if a bug is found after deployment?
It cannot be patched. That is the direct cost of immutability, and it is not softened anywhere in this documentation. The only responses available are the Closer key freezing the affected functions for up to 72 hours, and closing the affected branch permanently.
A failing component causes the closure of its branch, not its repair. Branches are separate contracts precisely so that this closure is survivable for everyone on the other branches.
Why immutable at all, if it means bugs cannot be fixed?
Because the alternative is worse in a specific way. An upgradeable lending protocol is a promise that whoever holds the upgrade key will not raise your liquidation ratio, change your interest rate, or repoint your collateral contract. That promise is only as good as the key holder, for as long as they hold it.
Immutability converts that promise into arithmetic. The cost is real and it is paid in full: nothing can be corrected, and an unanticipated corporate action can cause a permanent loss with no human safeguard in existence.
What if the chain stops?
Robinhood Chain has a sequencer. If it halts, you cannot repay, add collateral or withdraw until it resumes, and the protocol cannot read a fresh price. The protocol enters its BLIND regime and stops doing anything that needs a price.
There is no off-chain path around this, and nobody at Fyber can create one. It is listed as a mandatory disclaimer for that reason.
Can Fyber freeze my funds or block my address?
No. There is no allowlist, no blocklist and no address-level control anywhere in the contracts. The jurisdiction restriction is a front-end control on this website only. It is deliberately never enforced on chain, because an on-chain control operated by an identifiable person would defeat the point of the whole design.