> For the complete documentation index, see [llms.txt](https://docs.lumia.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lumia.org/ecosystem/lumia/chain-security/audits.md).

# Audits

An index of every confirmed security engagement around Lumia, what each one covered, and what remains unaudited.

**Who this is for:** issuers, developers, and operators evaluating Lumia's security posture who need to know what each engagement covered before relying on it.

What matters about an audit is its scope and whether it reached a final report, not how many were run. Findings are stated in the reports themselves, so read the report rather than a summary of it.

**Two firms, four engagements: Halborn and Hacken.** All four are **Solidity smart-contract reviews**. Three cover the token, staking, governance and migration contracts. The fourth is a code-difference report on a third-party DEX fork rather than a Lumia component. The chain protocol layer (the sequencer, zkProvers, data-availability layer, and bridge) is a separate scope that these engagements do not cover.

### Index of engagements

| Engagement                                                        | Stage                                                                                                                        | Platform / scope                                                                                            | Detail                                                                                                              |
| ----------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| Halborn: LUMIA token staking, governance and conversion contracts | Final report (Jul 22, 2024 update)                                                                                           | Solidity; `lumia` repo governance/staking/conversion contracts. Not the chain protocol layer.               | [Halborn Audit](https://app.gitbook.com/s/chmhPiVNAafGw48c4oU2/ecosystem/lumia/chain-security/audits/halborn-audit) |
| Hacken #1: Governance/staking/migration contracts                 | Final report (29 Jan 2025)                                                                                                   | Solidity; Lumia, BSC, Ethereum per report; veORN→veLumia migration contracts. Not the chain protocol layer. | [Hacken Audit](https://app.gitbook.com/s/chmhPiVNAafGw48c4oU2/ecosystem/lumia/chain-security/audits/hacken-audit)   |
| Hacken #2: LUMIA token (ERC20) contract                           | **Preliminary report only** (no Final Report entry exists for this engagement)                                               | Solidity; Ethereum; single ERC-20 contract. Not the chain protocol layer.                                   | [Hacken Audit](https://app.gitbook.com/s/chmhPiVNAafGw48c4oU2/ecosystem/lumia/chain-security/audits/hacken-audit)   |
| Hacken #3: Morphex DEX code-difference report                     | Final report (14 Feb 2025), but the report's own opening line states it **"should not be considered a security assessment"** | Solidity; a PancakeSwapV3 fork ("Morphex"), a DEX contract, not a Lumia chain component                     | [Hacken Audit](https://app.gitbook.com/s/chmhPiVNAafGw48c4oU2/ecosystem/lumia/chain-security/audits/hacken-audit)   |

Read the stage column before citing an engagement. A preliminary report is not a final report, and the Morphex code-difference report states in its own opening line that it should not be treated as a security assessment.

### Where to read the reports

The three Hacken reports are published on hacken.io and are linked from [Hacken audit](https://app.gitbook.com/s/chmhPiVNAafGw48c4oU2/ecosystem/lumia/chain-security/audits/hacken-audit). The Halborn report is client-held and is not published; see [Halborn audit](https://app.gitbook.com/s/chmhPiVNAafGw48c4oU2/ecosystem/lumia/chain-security/audits/halborn-audit) for its scope.

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Halborn Audit</strong></td><td>Halborn's 2024 assessment of the LUMIA token's staking, governance, and conversion contracts, and exactly what it covered.</td><td><a href="https://app.gitbook.com/s/chmhPiVNAafGw48c4oU2/ecosystem/lumia/chain-security/audits/halborn-audit">https://app.gitbook.com/s/chmhPiVNAafGw48c4oU2/ecosystem/lumia/chain-security/audits/halborn-audit</a></td></tr><tr><td><strong>Hacken Audit</strong></td><td>Three Hacken smart-contract engagements tied to Lumia: scope, report stage, and links to each published report.</td><td><a href="https://app.gitbook.com/s/chmhPiVNAafGw48c4oU2/ecosystem/lumia/chain-security/audits/hacken-audit">https://app.gitbook.com/s/chmhPiVNAafGw48c4oU2/ecosystem/lumia/chain-security/audits/hacken-audit</a></td></tr></tbody></table>