0% protocol fee on staked kUSD, for every holder. Mint kUSD →

0% protocol fee on staked kUSD, for every holder. Mint kUSD →

0% protocol fee on staked kUSD, for every holder. Mint kUSD →

0% protocol fee on staked kUSD, for every holder. Mint kUSD →

Kerne Logo
01Transparency02What Kerne is03Pricing04Institutional05Insights06Docs
Enter Terminal
Documentation

Security & Audits

Security Policy

Security is foundational to everything we build. We approach it as a multi layered discipline, not a checkbox.

Non Custodial Design

The Kerne Protocol is non-custodial at the smart contract level. On-chain collateral is held by the protocol's source-verified smart contracts on Base. A portion of vault assets is deployed to hedging venues such as Hyperliquid to maintain the delta neutral strategy. These off-chain positions are tracked transparently via the vault's offChainAssets variable and reported through the Proof of Reserves system. You retain the cryptographic right to initiate withdrawals at any time via the requestWithdrawal function.

Smart Contract Security

All contracts are written in Solidity 0.8.24 with OpenZeppelin v5.0 security primitives. The codebase has undergone multiple rounds of internal security review, with all critical findings patched and verified. The protocol has completed its first external audit: Hexens fieldwork ran from July 13, 2026 and the final report published on July 31, 2026 with ten findings, none critical, eight fixed and two acknowledged, internal adversarial audit reports are published at kerne.fi/security/audits, and external reports will be published on the Kerne transparency page when they land.

Our test suite includes hundreds of unit tests covering normal operations, edge cases, and adversarial scenarios. We use Foundry for testing, which allows us to simulate complex multi step interactions and verify that the contracts behave correctly under all conditions.

Multi-Layered Oracle System

The KerneOracleRouter dual-feed pricing system is deployed on Base at 0x5fAeaB501A33468775DDF929C714890eE7e984bc and administered by the 2-of-3 Safe. Earlier versions of this page said it was not yet deployed on-chain, which was wrong. What has not happened is the cutover: nothing on the live mint path reads it, its only configured asset is WETH, and USDC has no feed on it. As deployed: Pyth Network is the primary price feed, providing sub-second latency and confidence intervals. Chainlink AggregatorV3 is the validation and fallback layer. If the two sources disagree beyond the configured tolerance, minting through the router pauses until prices settle. Today the live PSM mint path does not use the router at all; it carries its own single-feed Chainlink staleness check on its USDC oracle, whose current window is published live as psm_chainlink_staleness_max at /api/risk-status.

Automated Circuit Breakers

The protocol includes multiple layers of automated protection:

  • Negative funding rate circuit breaker: Reduces hedge exposure during sustained negative funding periods to limit yield drag.
  • Exchange concentration limit: No single venue may hold more than a defined percentage of total hedge notional, enforced automatically.
  • Rapid outflow protection: If net withdrawals exceed a defined threshold of total value locked within a set period, new deposits are temporarily paused while positions are proportionally reduced.
  • Oracle anomaly circuit breaker: If price feeds diverge beyond threshold, new minting pauses automatically until convergence.
  • Collateralization ratio monitoring: If the ratio drops below defined thresholds, the protocol enters warning and then critical states with progressively more protective measures.

Multi Venue Diversification

The hedging engine is designed to spread positions across multiple venues, with hard caps limiting maximum exposure to any single venue. Today the hedge uses a single venue (Hyperliquid) and runs at pilot scale, sized against a small disclosed founder-custodied float (see kerne.fi/api/por); multi-venue routing arms as venues are added. Onchain collateral held in KerneVault is not affected by any single venue failure. It remains in the smart contracts under the protocol's control.

Emergency Unwind Procedure

In a catastrophic scenario requiring full protocol shutdown, a formalized emergency unwind procedure protects depositors: the vault pauses, hedge positions are closed in an orderly manner, and once fully unwound, the vault reopens for withdrawals only.

There is no backstop behind that shutdown today. The Insurance Fund holds a zero balance, which anyone can read directly from the chain and which the protocol publishes hourly as insurance_fund_usd in its signed attestation, so a shortfall in an unwind is borne by depositors in proportion to what they hold. Where a loss lands is set out under Loss Allocation in Risk Disclosures, and the empty fund is described in full at The Insurance Fund. This chapter will name a backstop when one is funded and not before.

External Audits

We are actively pursuing external security audits from reputable firms. Audit reports will be published publicly upon completion. We believe in full transparency around security, including disclosing findings and how they were addressed.