01
Collateral comes first.
Writers must lock the full underlying asset amount before offering an option. Locked collateral is not lent, restaked or reused elsewhere.
Fully backed at entry
SECURITY AT LEDIG
Security,
with the receipts.
Independent review. Clear safeguards.
A direct line for the unexpected.
ONCHAIN FX HEDGING
A closer look at how the protocol is designed, reviewed and improved.
01 / INDEPENDENT REVIEW
Open to inspection.
The findings, the fixes and the decisions.
Published for you to read.
Hexens
Ledig Protocol security review
September 2026 Smart contracts
0Critical, high or medium findings
1Low-severity finding
4Informational findings
4 fixed1 acknowledged
As recorded in the published reportView findings and outcomes
- LEDIG1-1LowFixed
Exercise when a writer cannot receive tokens
- LEDIG1-2InformationalAcknowledged
Writer allocation on partial exercise
The allocation trade-off is acknowledged. Proportional allocation was deferred for further testing.
- LEDIG1-3InformationalFixed
Repeated accounting updates
- LEDIG1-4InformationalFixed
Strike-rate decimal limits
- LEDIG1-6InformationalFixed
Unused fee-routing permissions
Scope matters: this review covers the smart contracts and code versions listed in the report. It is not certification of every Ledig product or a guarantee that vulnerabilities cannot exist.
02 / PROTOCOL SAFEGUARDS
Careful by design.
Security starts with how funds, permissions and exits fit together. These principles guide the protocol.
02
Each series has its space.
Each series has its own contract, vault and accounting. Settlement follows the writers backing that buyer's position.
Separate series. Clear accounting.
03
Clear roles. Controlled entry.
New buying and writing require approval. A wallet can enter as a buyer or a writer, with separate permissions for each role.
Approved participation
04
Pause risk. Preserve exits.
Pause controls stop new posting and buying. They are designed to preserve eligible exercise, cancellation and withdrawals under the contract rules.
Controls with a clear purpose
TESTNET
The protocol is in testing on Base Sepolia. Mainnet is not live. Audit completion and deployment status are separate.
03 / RESPONSIBLE DISCLOSURE
Found something
we should see?
Good questions welcome. Weird bugs too.
If you suspect a vulnerability in Ledig's website, services or protocol, report it privately to our team.
security@ledig.ioHelp us take a closer look.
A useful report includes:
- 01The affected service, page or contract address
- 02What you found and its possible impact
- 03Steps to reproduce the issue safely
- 04Relevant transaction hashes or screenshots
Never include private keys, seed phrases or passwords. Avoid accessing other people's data or moving funds. Please share details privately while we investigate.