> For the complete documentation index, see [llms.txt](https://docs.lumia.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lumia.org/ecosystem/lumia/chain-security/audits/hacken-audit.md).

# Hacken audit

The three Hacken smart-contract engagements tied to Lumia, what each one covered, and where to read the reports.

**Who this is for:** issuers, developers, and operators looking for the specifics of Hacken's security work tied to Lumia, beyond the fact that engagements exist.

**Auditor:** Hacken. Three Hacken reports for Lumia are published on hacken.io and are linked below. All three are **Solidity smart-contract engagements**. None of them reviewed Lumia's chain protocol layer (sequencer, zkProvers, data-availability layer, bridge). See [Audits](broken://pages/186ab696cbb42e5adbdd0f904a8891c25afe8b0e) for why that distinction matters before citing any of this.

This page does not restate finding counts or describe individual findings. Each report states its own, and the reports are linked. Read them there rather than through a summary.

## The three engagements

### 1. Governance, staking and migration contracts

| Field                          | Value                                                                                                                                                                 |
| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Report stage                   | **Final Report.** Changelog: 22 Jan 2025 Preliminary Report, 29 Jan 2025 Final Report.                                                                                |
| Platform (as stated in report) | Lumia, BSC, Ethereum                                                                                                                                                  |
| Language                       | Solidity                                                                                                                                                              |
| Repository                     | `github.com/orionprotocol/lumia`, branch `audit/veOrn-veLumia-migration`                                                                                              |
| Commit                         | `c8129b00df29916efe2a8a4606acbe7d84603d2d`                                                                                                                            |
| Scope                          | `VeOrnPausable.sol`, `VeLumiaMigrated.sol`, `Migrator.sol`, `veORNStorage.sol`, `Staking.sol`, `PausableLib.sol` (the veORN → veLumia staking-migration contract set) |
| Report                         | [SCA Lumia Governance Jan2025](https://hacken.io/audits/lumia/sca-lumia-governance-jan2025/)                                                                          |

### 2. LUMIA token (ERC20) contract

| Field                          | Value                                                                                                                                                                                                                                 |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Report stage                   | **Preliminary Report only.** Changelog states a single entry: "15/10/2024 - Preliminary Report." No Final Report entry exists anywhere in this document. A preliminary report is not a final report and is not presented as one here. |
| Platform (as stated in report) | Ethereum                                                                                                                                                                                                                              |
| Language                       | Solidity                                                                                                                                                                                                                              |
| Repository                     | `github.com/orionprotocol/lumia/blob/audit/contracts/Lumia.sol`                                                                                                                                                                       |
| Commit                         | `e2ae999704434f4d337d0dbf9f031371b29ba1b3`                                                                                                                                                                                            |
| Scope                          | `contracts/Lumia.sol` (the LUMIA ERC-20 token contract only)                                                                                                                                                                          |
| Report                         | SCA Lumia ERC20 Oct2024                                                                                                                                                                                                               |

### 3. Morphex DEX code-difference report

The report's own opening paragraph states: *"This Report aims to be solely a code comparison from PancakeSwapV3 to Morphex. As such, it should not be considered a security assessment: it is not proof or guarantee that the scope of this document is secure or behaves as expected."* Because the document itself disclaims being a security assessment, this page does not count it as an audit or use it as a trust signal, regardless of how any index page classifies it.

| Field                          | Value                                                                                                                                                                               |
| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Document type                  | Smart Contract Code Difference Evaluation Report (Hacken's own title); **not** a security assessment, per the report's own opening disclaimer above.                                |
| Report stage                   | Final Report, dated 14/02/2025.                                                                                                                                                     |
| Platform (as stated in report) | Lumia                                                                                                                                                                               |
| Repository                     | `github.com/morphex-exchange/MorphexV3_v1`                                                                                                                                          |
| Commit                         | `9deec19`                                                                                                                                                                           |
| Scope                          | A fork of PancakeSwapV3 (renamed "Morphex"), compared against the upstream PancakeSwapV3 codebase for naming/version differences (a DEX contract fork, not a Lumia chain component) |

## A note on the Orion name

The contracts audited in engagements 1 and 2 live in the orionprotocol GitHub organisation, and several assessed filenames carry the Orion name. That is the pre-rebrand organisation. The engagements are filed under Lumia on hacken.io.

## What this page does not say

This page does not state that any Hacken engagement "passed," found "no critical issues," or confirms the security of the Lumia chain itself. None of the three engagements reviewed the sequencer, zkProvers, data-availability layer, or bridge; see [Audits](broken://pages/186ab696cbb42e5adbdd0f904a8891c25afe8b0e). It does not present the Morphex diff report as a security assessment or as an audit, because the report explicitly says it is neither. It states no finding counts and describes no individual finding, in either direction. The reports are linked above and speak for themselves.