Smart Contract Audits
Last updated
Alvara Protocol's smart contracts have been independently audited by three security firms: CertiK, QuillAudits, and Adevar Labs.
Full security assessment of the staking platform and BSKT core contracts, covering BSKT.sol, Factory.sol, and BSKTPair.sol. Methods included formal verification, manual review, and static analysis.
Auditor: CertiK Date: June 12, 2025 Scope: Staking, BSKT Factory, BSKT, BSKTPair (EVM Compatible) Findings: 18 total — 14 resolved, 4 acknowledged. 1 critical (resolved), 2 major (1 resolved, 1 acknowledged), 4 medium (all resolved), 8 minor (6 resolved, 2 acknowledged), 2 informational (all resolved). Report: CertiK Audit Report (PDF)
The core BSKT creation and management contracts have been audited. This covers the factory contract, basket token logic, deposit/redemption mechanics, and rebalancing functionality.
Auditor: QuillAudits Report: BSKT Factory Audit Report (PDF)
The ALVA staking contract (time locks, forever locks, veALVA calculation, reward distribution) has been audited.
Auditor: QuillAudits Report: Staking Audit Report (PDF)
The ALVA token deployment on Avalanche C-Chain has been audited.
Auditor: QuillAudits Report: ALVA Token AVAX Audit Report (PDF)
Security assessment focused on the 1inch swap integration, covering BSKT.sol, Factory.sol, BSKTPair.sol, and BSKTUtils.sol. Reviewed partial-fill handling, LP token accounting, fee calculation logic, and ETH recovery mechanisms.
Auditor: Adevar Labs Date: January 29, 2026 Scope: 1inch integration — BSKT, Factory, BSKTPair, BSKTUtils contracts Findings: 6 total — 3 high (2 resolved, 1 partially resolved), 2 medium (2 partially resolved), 1 low (resolved). 2 enhancement opportunities noted. Report: Adevar Labs 1inch Integration Audit Report (PDF)
The audits collectively cover:
Smart contract logic and correctness
Access control and permission models
Reentrancy and common vulnerability checks
Flashloan and price manipulation vectors
Economic attack vectors (inflation, reserve manipulation)
Centralization risks
Gas optimization
Audits reduce risk but do not eliminate it. Smart contracts are complex software and may contain undiscovered vulnerabilities. All interactions with Alvara Protocol carry inherent smart contract risk. See Risk Disclosures for more information.
Last updated