Security
Security & Audits
Apyee's V2 Vault contracts are audited by Soken, and the full Solidity source is public. Every finding — including where we started — is published below.
Audit timeline
We publish every step, including the 55/100 starting point. The message is not “flawless” — it is every finding surfaced, and every finding fixed.
Initial Audit · V2
55/10016 findings, including 1 Critical. Full report published — nothing withheld.
Soken-APY-2026-06-001 (PDF)Deep Review · V2.1.1
78/100Every initial finding verified fixed, plus a fresh review of the new claim / compound reward code.
Soken-APY-2026-06-002 (PDF)Remediation Review · V2.1.2
88/1008 of 8 recommendations CLOSED, zero regressions. Overall verdict: PASS.
Soken-APY-2026-06-002 (PDF)Residual Review · V2.1.3
91/100Addendum review — 0 new findings, remaining 2 Low addressed. PASS, coverage extended to the deployed tag.
Soken-APY-2026-06-002-B (PDF)
Audit reports
Full PDFs — hosted on our GitHub release, with the final report also published by Soken. No login required.
Verified deployment
Deployed bytecode is built from tag v2.1.3 (commit e737779), source-verified on Etherscan, BaseScan, Arbiscan, and BscScan. Reproduce it from source, or verify each contract on its chain explorer.
Two independent checks, on different things. Soken audits the code; DefiLlama independently tracks the live TVL — one verifies what the contracts do, the other verifies what is actually deposited. DefiLlama's listing links back to the Soken audit, so the same facts cross-reference across independent sites.
Owner is a Gnosis Safe multi-sig (2 of 3) — the same address across all 4 chains. No single key can change a parameter or add a strategy; the contracts themselves are immutable.
| Chain | Vault | Strategies |
|---|---|---|
| Ethereum | 0xE46a…D5f7 | 5 verified |
| Base · Balanced | 0xeA8F…529a | 4 verified |
| Base · Aggressive | 0x8792…7F85 | 8 verified |
| Arbitrum | 0x94f8…049C | 4 verified |
| BNB Chain | 0x27DB…f5Bf | 2 verified |
All 5 Vaults and their strategy adapters are verified on their chain explorer, built from the audited v2.1.3 tag. Contracts are immutable.
Trust model
Immutable, non-upgradeable
The Vault has no proxy and no upgrade path. Deployed logic cannot be swapped out from under you — what is audited is what runs.
Scoped roles — no custody
Owner — a 2 of 3 Safe multi-sig — sets parameters and adds strategies; Keeper only rebalances and harvests; Guardian can pause. None of them can move or withdraw user funds. Assets stay in the Vault contract.
Withdraw survives pause
Even while the Vault is paused, users can still withdraw their principal. Pause blocks new deposits and rebalancing, never your exit.
Read the full Trust Model — Owner powers and residual risks, in detail.
An audit lowers risk; it is not a guarantee of safety, and does not remove smart-contract risk. Read the reports and use at your own risk.
Responsible disclosure
Found a security issue? Report it privately to [email protected]. Please give us a reasonable window to fix before public disclosure.