Audits

An index of every confirmed security engagement around Lumia, what each one covered, and what remains unaudited.

Who this is for: issuers, developers, and operators evaluating Lumia's security posture who need to know what each engagement covered before relying on it.

What matters about an audit is its scope and whether it reached a final report, not how many were run. Findings are stated in the reports themselves, so read the report rather than a summary of it.

Two firms, four engagements: Halborn and Hacken. All four are Solidity smart-contract reviews. Three cover the token, staking, governance and migration contracts. The fourth is a code-difference report on a third-party DEX fork rather than a Lumia component. The chain protocol layer (the sequencer, zkProvers, data-availability layer, and bridge) is a separate scope that these engagements do not cover.

Index of engagements

Engagement	Stage	Platform / scope	Detail
Halborn: LUMIA token staking, governance and conversion contracts	Final report (Jul 22, 2024 update)	Solidity; lumia repo governance/staking/conversion contracts. Not the chain protocol layer.	Halborn Audit
Hacken #1: Governance/staking/migration contracts	Final report (29 Jan 2025)	Solidity; Lumia, BSC, Ethereum per report; veORN→veLumia migration contracts. Not the chain protocol layer.	Hacken Audit
Hacken #2: LUMIA token (ERC20) contract	Preliminary report only (no Final Report entry exists for this engagement)	Solidity; Ethereum; single ERC-20 contract. Not the chain protocol layer.	Hacken Audit
Hacken #3: Morphex DEX code-difference report	Final report (14 Feb 2025), but the report's own opening line states it "should not be considered a security assessment"	Solidity; a PancakeSwapV3 fork ("Morphex"), a DEX contract, not a Lumia chain component	Hacken Audit

Read the stage column before citing an engagement. A preliminary report is not a final report, and the Morphex code-difference report states in its own opening line that it should not be treated as a security assessment.

Where to read the reports

The three Hacken reports are published on hacken.io and are linked from Hacken audit. The Halborn report is client-held and is not published; see Halborn audit for its scope.

Halborn Audit

Halborn's 2024 assessment of the LUMIA token's staking, governance, and conversion contracts, and exactly what it covered.

Hacken Audit

Three Hacken smart-contract engagements tied to Lumia: scope, report stage, and links to each published report.