Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Audit & security

Kumbaya runs on contracts that have been audited by independent third parties. This page is the short version of who audited what, and what you do - and don't - control as a user.

Two protocol layers, both audited

Kumbaya has two protocol layers on top of each other: a DEX that's a fork of Uniswap V3, and the Kumbaya launchpad (whose smart contracts are prefixed Fire* - a campfire metaphor that fits the "Kumbaya" name). Each layer has its own audit history.

🔥 Kumbaya launchpad - BlockSec

Every launchpad contract - FireLaunch, FireToken, FireGraduator, FireRegistry, FireStream, FuelVault - was reviewed by BlockSec, a well-known smart-contract security firm. The audit covered the full launch → graduation → fee-streaming flow, the on-token vesting, and the tip-credit ledger.

No critical or high findings remain open.

The full signed report is published in the integrator-kit: blocksec_Kumbaya-xyz_Fire_v1.0-signed.pdf.

💱 DEX - inherits Uniswap V3's audits

Kumbaya's DEX is a fork of Uniswap V3, which has been live since May 2021 and is one of the most battle-tested AMMs in DeFi. The Kumbaya fork is bytecode-equivalent to the upstream Uniswap V3 code (verified by an automated check in our integrator-kit) - so it inherits every audit Uniswap V3 has had.

The two formal V3 audits are public and live in Uniswap's v3-core repo:

Kumbaya's only protocol-level change to V3 is a wider protocol-fee range at the contract level (max 50% vs. upstream's 25%) - though in production Kumbaya runs within Uniswap's standard range (see Fees). Pools, positions, the swap engine, and tick math are otherwise unchanged.

What this means for you

  • Your funds aren't held by Kumbaya. When you swap, your tokens move directly between you and the pool contract. When you provide liquidity, your position is an NFT in your wallet. When you launch a token, the launchpad doesn't custody it.

  • Kumbaya can't freeze, seize, or redirect your assets. No admin function exists for that on the protocol contracts.

  • Kumbaya can't reverse trades or refund mistakes. Transactions are final once confirmed on-chain.

  • Launchpad tokens are safe at the contract level. Every token launched through the launchpad is a FireToken deployed by the audited FireLaunch contract - the same bytecode every time. There's no admin who can mint more, blacklist holders, freeze transfers, or take fees. Audit coverage extends to every launch.

What's not audited

  • Third-party tokens deployed outside the launchpad (i.e. tokens you import manually by contract address - not launched via kumbaya.xyz/launchpad/create). Anyone can deploy an arbitrary ERC-20 with admin powers, transfer hooks, or hidden taxes. The audit doesn't extend to those. The Kumbaya UI flags these with an Unknown badge - see Swapping tokens → Unknown tokens carry real risk.

  • Off-chain services (the website, the search service, the indexer). These can have bugs that affect what you see, but they can't move funds - only your wallet can, and only with your signature.

If you find a security issue

Email support@kumbaya.xyz with details. Please don't disclose publicly until we've had a chance to fix it.

Where to next

PreviousTroubleshooting

Last updated