Think adversarially
For every critical component, we ask what could go wrong, including unlikely and worst-case scenarios, and design around those possibilities.
Protocol security
Security is not a claim.
It is an ongoing process.
While no decentralized protocol can eliminate every vulnerability, there is a lot that can be done to reduce risk.
At Money On Chain, security means continuously questioning assumptions, examining worst-case scenarios, strengthening the protocol, and being prepared to act when something unexpected happens.
From protocol design and independent audits to an open bug bounty program and public incident reporting, security is treated as a continuous responsibility, not a one-time review.
01 / Our approach
Security shapes how we build.
Security is considered throughout the lifecycle of the protocol, from the assumptions behind a new feature to how the system should behave under unexpected conditions.
Reduce the impact
Not every risk can be eliminated. The protocol includes mechanisms and operational procedures designed to contain potential failures and protect its core functions.
Be ready to act
Security planning includes predefined procedures for evaluating incidents, coordinating a response, and communicating what is happening.
Security takes priority
When a security concern appears, addressing it takes precedence over shipping new functionality.
02 / Continuous security
Security doesn’t end at deployment.
Question
Challenge assumptions and consider adverse scenarios.
Test
Review implementations through internal testing, external audits, and independent security research.
Harden
Turn findings into improvements to contracts, infrastructure, and operational procedures.
Monitor
Follow protocol behavior and emerging risks after deployment.
Act
Use established procedures and protocol safeguards when intervention becomes necessary.
Learn
Document incidents and use what was learned to strengthen the protocol.
“We assume that something can go wrong, and we design and operate the protocol accordingly.”
03 / Open research
Help us find what we missed.
Money On Chain maintains a public bug bounty program on Immunefi, inviting independent security researchers to identify vulnerabilities across smart contracts, applications, oracle infrastructure, and governance.
View bug bountyPublic bug bounty
Since2021
Assets in scope56
Rewardup to $10K
04 / Independent review
Independent review matters.
External security reviews provide another layer of scrutiny to the protocol. Money On Chain works with independent auditors to identify potential vulnerabilities and strengthen its implementation.
View audit reportsSmart contractsReviewed
Oracle infrastructureReviewed
Protocol mechanicsReviewed
GovernanceReviewed
05 / Transparency
When something happens, we make it visible.
Security incidents and protective actions are documented publicly. This history provides a clear record of what happened, what was affected, and how the protocol responded.
IR–02
Panic button activated
ResolvedMinting and redemption operations were temporarily affected after a protocol safeguard was activated.
No material losses occurred and protocol solvency was not affected.IR–01
Reverse auctions incident
ResolvedAn issue affecting MOC staking rewards resulted in unintended value extraction over an extended period.
Protocol solvency and user collateral were not affected.
06 / Open governance
Security work happens in public.
Protocol hardening does not only happen behind closed doors. Security-related improvements, governance discussions, and incident analyses are published through the Money On Chain governance forum, allowing the community to follow how the protocol continues to evolve.
Explore the governance forum07 / Resources
Want to go deeper?
01
Security researchers
For every critical component, we ask what could go wrong, including unlikely and worst-case scenarios, and design around those possibilities.
Explore Immunefi ↗02Developers
Not every risk can be eliminated. The protocol includes mechanisms and operational procedures designed to contain potential failures and protect its core functions.
Read the documentation ↗03Community
Security planning includes predefined procedures for evaluating incidents, coordinating a response, and communicating what is happening.
Visit governance forum ↗