> For the complete documentation index, see [llms.txt](https://docs.familio.trade/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.familio.trade/developers/security.md). # Security ## Trust model You trust **code you can read**, not familio-the-website. * Funds sit in `FamilyVault` clones. The website cannot `swap`, `leave`, or `pauseExits`. Hiding a family from explore does not touch the vault; members can still leave. * The **head** (and co-pilots) choose what to trade. That is market risk and key risk, not a backdoor: they still cannot send your slice to themselves. * The **factory owner** can pause trading/joins protocol-wide, pause exits for ≤ 72 hours (and then the contract forces 72 hours of open exits before it can pause again — no rolling freeze), change the protocol fee (≤ 5%), block a router or a token, and change the treasury. They cannot drain a vault. * **Routers** are allow-listed. Safety is balance deltas, not a decoder that understands every Uniswap command. A bizarre payload can still land dust in an untracked token; that value stays in the vault (leave with `extra`). * **Robinhood Chain**, Uniswap, Pons, WETH, USDG, and your wallet are outside this repo. familio.trade is a read-and-build-tx frontend. A malicious UI could still ask you to sign the wrong thing. Check the vault address on the explorer. Reject unexpected approvals. Some wallets (MetaMask included) used to show a "malicious site" banner on familio.trade while their scanners caught up with a new domain. **Blockaid reviewed the site in September 2026** and the flag was removed; allow up to 24 hours for that to propagate in every wallet. That does not change the risk above — tokens can still go to zero, contracts are still unaudited, and you should still read what you sign. ## Audit status You can lose everything. Tokens can go to zero — small caps often do, fast, for no reason. A head can trade in good faith and still lose 100% of the vault. Nothing is insured. Only put in what you can watch go to zero. The contracts are fully source-verified: what you read is byte-for-byte what runs on chain. Read them yourself on Blockscout — [FamilyFactory](https://robinhoodchain.blockscout.com/address/0x6716e9df55Bdf2572Ec8C5E58Ca7b75b10dDEB12?tab=contract) and the [FamilyVault implementation](https://robinhoodchain.blockscout.com/address/0x80897D73649b5A5ce3cf0604bD553Cb9ACB6C68F?tab=contract) behind every family, both green-badged "exact match". The same code is verified on [Sourcify](https://sourcify.dev/#/lookup/0x6716e9df55Bdf2572Ec8C5E58Ca7b75b10dDEB12) as an independent second check. There is no third-party audit yet; open source means anyone can check the code, not that someone already has. An audit, when published, will be linked from [familio.trade/legal](https://familio.trade/legal) and from this page. What an audit **would** cover: the Solidity (FamilyFactory, FamilyVault, PonsAdapter), typical issues (reentrancy, auth, share math, fee accounting, clone init, router delta checks), and the invariants the tests already encode. What an audit **would not** cover: whether a head is honest, whether a token is a rug, whether a Uniswap or Pons pool is liquid, whether the website is up, whether the indexer is lagged, or whether you should deposit. ## Known limits * **Token risk.** Tokens can go to zero — small caps often do. Frozen or blacklisting tokens can break a naive `leave`; use `leaveWith` skip. `MAX_HELD_TOKENS` is 30; `leave` is O(held tokens). * **Router risk.** Generic calldata. Multi-hop can credit a token the vault does not track. Indexers should watch `Transfer` into the vault. * **Head risk.** Bad trades, asleep with trading locked and no co-pilot, `setIgnored` on a valuable bag then joining, eviction (you still get the slice). Crew lock is how members pin the people they joined under. * **Turbo mode.** A browser session key trades on behalf of the trader with no wallet popups. Anyone with access to that browser can fire swaps while turbo is on. The key can only swap — it cannot withdraw funds, change rules, or take other actions, but it is still live trading power. * **`setIgnored`.** New joiners get a free claim on ignored bags. For dust only. * **Join legs** are built off-chain. An under-filled leg lowers *your* shares, never anyone else's. * **Pushed rewards.** ERC-20s and ETH are kept, never rejected. Tiny WETH pushes are not auto-tracked. `receive()` needs more than a 2300-gas stipend to wrap. * **Dust supply.** Joins refuse `totalShares < 1e9`. * **Empty pool.** If shares exist but free quote and live bags are all zero (everything distributed), joins revert — the head must refill before anyone can mirror in. Escrowed approval-mode deposits stay refundable via `cancelRequest`. * **The implementation contract** can be `initialize`d by anyone; it holds no funds and clones do not read its storage. Clones themselves are one-shot. ## Reentrancy `FamilyVault` is `ReentrancyGuard`. `join`, `leave`, `leaveWith`, `swap`, `distribute`, `claim`, `claimFor`, `claimHeadFees`, `found`, `requestJoin`, `declineJoin`, `cancelRequest`, `completeJoin`, `evict` are `nonReentrant`. Paying WETH vaults unwraps then `call`s the recipient with a 50\_000 gas stipend and falls back to WETH if that fails — a recipient that re-enters still hits the guard. Tests cover a member trying to re-enter `leave` or `claim` from `receive`. PonsAdapter is stateless and only moves tokens between `msg.sender` and the venue. ## Bug reporting If you find a vulnerability in the contracts or the app, **do not** post it as a public GitHub issue or in Telegram. * Preferred: DM [@FamilioTrade](https://x.com/FamilioTrade) with a high-level description and a way to reach you. We will ask for a private write-up. * Do not test exploits against live vaults with other people's funds. * There is no published bug bounty schedule yet. We will still treat a responsible report as such. Legal and risk copy also lives at [familio.trade/legal](https://familio.trade/legal). That page is not this spec; if they disagree, the contracts win. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.familio.trade/developers/security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.