Hacken audit

The three Hacken smart-contract engagements tied to Lumia, what each one covered, and where to read the reports.

Who this is for: issuers, developers, and operators looking for the specifics of Hacken's security work tied to Lumia, beyond the fact that engagements exist.

Auditor: Hacken. Three Hacken reports for Lumia are published on hacken.io and are linked below. All three are Solidity smart-contract engagements. None of them reviewed Lumia's chain protocol layer (sequencer, zkProvers, data-availability layer, bridge). See Audits for why that distinction matters before citing any of this.

This page does not restate finding counts or describe individual findings. Each report states its own, and the reports are linked. Read them there rather than through a summary.

The three engagements

1. Governance, staking and migration contracts

Field	Value
Report stage	Final Report. Changelog: 22 Jan 2025 Preliminary Report, 29 Jan 2025 Final Report.
Platform (as stated in report)	Lumia, BSC, Ethereum
Language	Solidity
Repository	github.com/orionprotocol/lumia, branch audit/veOrn-veLumia-migration
Commit	c8129b00df29916efe2a8a4606acbe7d84603d2d
Scope	VeOrnPausable.sol, VeLumiaMigrated.sol, Migrator.sol, veORNStorage.sol, Staking.sol, PausableLib.sol (the veORN → veLumia staking-migration contract set)
Report	SCA Lumia Governance Jan2025

2. LUMIA token (ERC20) contract

Field	Value
Report stage	Preliminary Report only. Changelog states a single entry: "15/10/2024 - Preliminary Report." No Final Report entry exists anywhere in this document. A preliminary report is not a final report and is not presented as one here.
Platform (as stated in report)	Ethereum
Language	Solidity
Repository	github.com/orionprotocol/lumia/blob/audit/contracts/Lumia.sol
Commit	e2ae999704434f4d337d0dbf9f031371b29ba1b3
Scope	contracts/Lumia.sol (the LUMIA ERC-20 token contract only)
Report	SCA Lumia ERC20 Oct2024

3. Morphex DEX code-difference report

The report's own opening paragraph states: "This Report aims to be solely a code comparison from PancakeSwapV3 to Morphex. As such, it should not be considered a security assessment: it is not proof or guarantee that the scope of this document is secure or behaves as expected." Because the document itself disclaims being a security assessment, this page does not count it as an audit or use it as a trust signal, regardless of how any index page classifies it.

Field	Value
Document type	Smart Contract Code Difference Evaluation Report (Hacken's own title); not a security assessment, per the report's own opening disclaimer above.
Report stage	Final Report, dated 14/02/2025.
Platform (as stated in report)	Lumia
Repository	github.com/morphex-exchange/MorphexV3_v1
Commit	9deec19
Scope	A fork of PancakeSwapV3 (renamed "Morphex"), compared against the upstream PancakeSwapV3 codebase for naming/version differences (a DEX contract fork, not a Lumia chain component)

A note on the Orion name

The contracts audited in engagements 1 and 2 live in the orionprotocol GitHub organisation, and several assessed filenames carry the Orion name. That is the pre-rebrand organisation. The engagements are filed under Lumia on hacken.io.

What this page does not say

This page does not state that any Hacken engagement "passed," found "no critical issues," or confirms the security of the Lumia chain itself. None of the three engagements reviewed the sequencer, zkProvers, data-availability layer, or bridge; see Audits. It does not present the Morphex diff report as a security assessment or as an audit, because the report explicitly says it is neither. It states no finding counts and describes no individual finding, in either direction. The reports are linked above and speak for themselves.