Security Overview

This page provides a summary of how appeX approaches security: the principles that guide design decisions, the specific measures in place, and where trust is required versus where operations are verifiable.

Security Principles

appeX handles real capital. Security is not a feature. It is a prerequisite for every design decision. The protocol is built around three principles:

Defense in depth. No single control prevents all attacks. Multiple layers of protection overlap so that failure of any one layer does not compromise the system. Smart contract audits catch code-level issues. The bug bounty program catches what audits miss. Redemption gates prevent liquidity crises. Concentration limits prevent single-point-of-failure exposure. Each layer operates independently.
Transparency over obscurity. Smart contracts are audited and published. Risk factors are documented openly in this documentation. Users make informed decisions, not blind ones. appeX believes that transparent risk disclosure builds trust. Hiding risks does not eliminate them. It transfers them to uninformed participants.
Minimize trust assumptions. Onchain operations are verifiable by anyone. NAV calculations, fee distributions, staking mechanics, and LP token pricing are all executed by smart contracts. Offchain operations (borrower onboarding, credit assessment) are the primary trust boundary, and they are documented explicitly so users understand exactly where trust is required.

Security Measures

Category	Measures	Purpose
Smart contract security	Third-party audits, bug bounty program	Identify and eliminate code-level vulnerabilities before and after deployment
Access control	Permissioned borrower onboarding, planned multi-sig administration, role-based access	Prevent unauthorized vault draws and parameter changes
Geographic restrictions	Geofencing for restricted jurisdictions enforced at the frontend layer	Prevent access from prohibited regions
Liquidity protection	Redemption gates (daily caps, available liquidity checks, per-request limits)	Prevent bank-run dynamics and protect vault solvency during stress
Risk isolation	Vault-level capital and risk separation	Ensure losses in one vault do not affect other vaults or their LPs
Capital preservation	All unborrowed capital deployed to established, audited DeFi protocols (Aave, Compound) for continuous yield	Minimize external dependency risk while ensuring capital is always productive
NAV integrity	Continuous accrual, NAV refresh on every transaction	Prevent timing arbitrage and ensure fair pricing for all LP transactions

Trust Boundaries

appeX operates at the intersection of onchain and offchain systems. Understanding where trust is required is critical for making informed decisions about participation.

Onchain (Verifiable)

These operations will be handled onchain and independently verifiable:

LP deposits and redemptions
NAV calculations and share pricing
$APPEX staking and reward distribution
Fee distribution mechanics
LP token minting and burning

Offchain (Trust Required)

These operations require trust in the appeX team's judgment and processes:

Borrower creditworthiness assessment and onboarding decisions
Receivable verification and fraud checks
Collections management and repayment tracking
Fiat off-ramp operations and banking relationships
Borrowing limit adjustments and term modifications

The offchain layer exists because credit decisions require human judgment. Evaluating whether a company can repay its obligations, verifying that receivables are legitimate, and managing collections processes require expertise and discretion. As the protocol matures, governance will progressively decentralize these decisions.

Warning: The offchain layer is the primary trust boundary in the system. LP capital is deployed to borrowers based on offchain credit decisions made by the appeX team. While borrower onboarding is rigorous, this represents a centralization point that users should understand. See Risk Framework for a complete analysis.

Phased Security Approach

Security is not a one-time event. appeX follows a phased approach:

Pre-launch. Third-party security audits of all smart contracts. Internal testing of core financial logic.
Launch. Conservative initial parameters. Gradual deployment with volume limits. Monitoring for unexpected behavior.
Post-launch. Ongoing bug bounty program. Continuous monitoring. Governance-driven parameter adjustments based on real usage data.