Security and audits
Security in DeFi is layered: code review before launch, transparent backing while running, a way to reward people who find bugs, and habits on your side of the screen. Solv works on all four. None of them, alone or together, makes anything risk-free — and this page won’t pretend otherwise.
Third-party audits
Solv’s contracts — from the ERC-3525 reference implementation through the SolvBTC components — have been reviewed by multiple independent security firms. Names that have appeared across its audit history include Quantstamp, CertiK, SlowMist, Salus and Secbit. Audits examine code for known classes of vulnerability and logic errors before and during deployment.
What an audit is, and isn’t: it’s a serious expert review at a point in time, not a permanent guarantee. Code changes, integrations add new surface area, and no review catches everything. Treat “audited” as a meaningful positive signal, not a promise of safety.
Proof of reserve
For a Bitcoin-backed token, the central question is whether the backing is real. Solv addresses this with proof of reserve — publishing the relationship between Bitcoin held in reserve and SolvBTC in circulation, with third-party verification. This is what lets the 1:1 claim be checked instead of trusted. Because reserves move as the protocol operates, proof-of-reserve data is something to read live rather than assume from a fixed figure. See how it works for the model.
Bug bounty
Solv runs a public bug-bounty program, inviting security researchers to report vulnerabilities responsibly in exchange for rewards. Bounties are valuable because they put many independent eyes on the code continuously, beyond the formal audit windows, and create an incentive to disclose rather than exploit.
What you control: anti-phishing
Most people who lose funds aren’t undone by a contract exploit — they’re phished. These habits prevent the large majority of real-world losses:
- Never share your seed phrase or private keys. Not with “support”, not to “validate” a wallet, not ever. No legitimate process needs them.
- Solv will not DM you first. Treat unsolicited messages, giveaways and “urgent” claims as scams by default.
- Verify the domain. Read the address bar carefully before connecting a wallet or signing. Clones copy real sites pixel-for-pixel.
- Verify contract addresses against official channels before interacting with a token or contract.
- Bookmark trusted resources and navigate from your bookmarks, not from search ads or links in chats.
- Review every signature. Understand what a transaction approves; be wary of unlimited token approvals to unfamiliar contracts.
- Revoke stale approvals you no longer use, with a reputable approval-checker tool.
Verifying official channels
Because this site deliberately avoids linking the main domain, use the official social and developer channels to confirm anything that matters — contract addresses, proof-of-reserve data, governance interfaces and announcements. They’re linked in the footer of every page (X, Telegram, Discord, Medium, GitHub). When in doubt, cross-check a claim across more than one official channel before acting on it.
DeFi rewards the careful. Assume that anything promising guaranteed returns or asking for secrets is hostile, keep position sizes sane, and read risks & liquidations so you know what you’re accepting.
Related: Risks & liquidations · FAQ