Most major crypto losses trace back to a single point of failure. Of the $16 billion lost to crypto hacks to date, close to 40% stems from compromised keys rather than flaws in the underlying code, and most of the remainder hit contracts that had already been audited. Neither key management nor audit alone is sufficient. NUVA is designed so that no individual control carries the whole system. Security is structured across three layers, people, code, and operations, spanning prevention through real-time response.

TL;DR

• Three independent layers: people and access, code and contracts, operations. No single failure exposes assets. 

• People & access: Contract keys are held under a 5-of-8 multisig, requiring 5 independent approvals before any privileged action executes, with hardware-based key storage and enforced role separation. No single key can mint, upgrade, or pause. 

• Code & contracts: Every significant release is independently audited by leading security firms. All live changes are subject to a 48-hour delay, and a public bug bounty remains open for external disclosures.

• Operations: On-chain activity is monitored 24/7 with automated vault pause capability, supported by full-stack infrastructure monitoring, AML screening on every deposit and redemption, and OFAC sanctions-based access restrictions. 

• Incident response: A documented response protocol operates on a 24-hour basis, with global pause authority and mandatory root-cause review preceding any resumption of operations. 

Layer 1: People & Access

Access controls are designed on the principle that no single compromised device, key, or individual can place assets at risk. 

• 5-of-8 multisig: Privileged contract operations require approval from 5 of 8 designated signers. No individual key holds administrative authority.

• Hardware-based key storage: Keys are held on-device and are non-exportable. Private keys are never loaded onto internet-connected systems, and service account credentials are held in enterprise key management and hardware security module infrastructure under least-privilege access controls.

• Role separation: Authority is segregated by function. No single key can mint, upgrade, and pause.

• Personnel controls: Team members are trained on spotting phishing and social engineering, which remain among the most common initial attack vectors.

• Continuous security operations: Accounts, infrastructure, and smart contracts are monitored on a 24-hour basis, with signers distributed across Asia, EU, and US.

Layer 2: Code & Contracts

Every NUVA contract goes through a multi-stage review across its full lifecycle, from development through live operation.

• Established standards: Contracts are built on OpenZeppelin's audited implementations on Ethereum and a purpose-built vault module on Provenance, combining widely adopted patterns with NUVA's continuous compounding mechanics.

• Independent audit before every significant release: NUVA engages Sherlock and Halborn, two independent smart contract security firms, and publishes all audit reports for external review. [View audit reports →]

• 48-hour timelock: Any change to a deployed contract is queued publicly and executes only after 48 hours, providing a defined window for detection and intervention. 

• Always-on bug bounty: Live contracts are covered by an Immunefi bug bounty program rewarding responsible disclosure of vulnerabilities. 

Layer 3: Operations

Live infrastructure is continuously monitored and screened, backed by automated and manual safeguards that can halt operations within seconds.

• Automated safeguards: Hypernative, an on-chain threat detection platform, watches vault activity 24/7 and can trigger an automatic pause on suspicious behaviour. Datadog, an infrastructure monitoring platform, covers service health and performance across the NUVA stack.

• Manual controls: Beyond automation, NUVA holds manual pause authority, with signers across time zones ready to act at any hour.

• Compliance screening: Every vault deposit and redemption is screened in real time for anti-money laundering risk, and access from sanctioned regions is blocked by default in line with OFAC rules.

Incident Response and Holder Protection

Preventive controls address the majority of risk. The following protocol outlines what takes place in the event of detected suspicious activity.

• Detection: Anomalies are flagged the moment they appear.

• Pause: Vaults can automatically halt within seconds. In parallel, a signer can invoke a manual global pause. All vault entry and exit are suspended.

• Root-cause analysis: The response team convenes within one hour, followed by a written postmortem.

• Resumption: Vaults are resumed only after completed review and multisig approval.

A pause is a protective measure and does not leave holders without recourse. Four conditions hold throughout an incident:

• Backing remains intact. A controlled pause preserves net asset value. For holders who have borrowed against NUVA vault tokens, the bad debt risk arising from a brief halt is materially lower than that of a vault drained through unauthorized access.

• Liquidation routes remain available via DEXes. Supported DEX pools remain live throughout a pause, allowing positions to be unwound on the open market.

• Supply cannot be inflated. Token supply is constrained at the chain level on Provenance, meaning a mint exploit cannot issue unbacked tokens. Backing is preserved regardless.

• Exits are throttled, not capped. Large redemptions trigger alerts, Hypernative circuit breakers monitor multiple parameters concurrently, and every withdrawal clears an AML check within a defined window or is reversed. Attacker exit velocity is constrained without restricting legitimate holders.

No single control secures a protocol. Layered controls do, and every layer described above is documented, tested, and operational.

Want to dive deeper into NUVA’s security approach and development standards? Read the Security & Trust documentation.