The problem SecureFi solves

The Problem It Solves

When exploits happen in crypto, millions of dollars are lost, damaging trust and discouraging new users from joining the ecosystem. For example, incidents like the Euler Finance exploit and Beanstalk hack have shown how devastating gaps can be. More recently, in November 2025, the Balancer protocol suffered a major exploit that drained over $128 million across multiple blockchain networks due to a combination of access control flaws and precision manipulation bugs.

These incidents highlight that even well-established and audited protocols remain vulnerable to complex smart contract exploits. For early-stage projects and startups, the challenge is even greater - many cannot afford professional audits or bug bounty programs, leaving them with minimal security assurance. This lack of accessible security infrastructure not only makes emerging projects easy targets but also undermines the overall credibility and growth of the Web3 ecosystem.

Our Solution - SecureFi

We've built SecureFi, a Yield-Donating Vault powered by Octant V2, designed to fund on-chain security in a sustainable and transparent way.

With SecureFi, DAOs, ecosystem foundations, and community members who care about blockchain security can deposit stable assets into the vault. These deposits generate yield through trusted DeFi protocols. Instead of distributing that yield back to depositors, it is donated each epoch to fund bug bounties and audits for projects that can't afford them.

Currently, SecureFi integrates with Cantina, a leading auditing and bug bounty platform. The generated yield is directed to security researchers who identify and report verified vulnerabilities in registered projects. This ensures that small teams can still maintain strong security practices without the financial burden.

In the future, we plan to:

• Expand integration to other auditing and security platforms such as Immunefi, HackerProof, and more.
• Develop more efficient and secure yield-generating strategies.
• Optimize the yield distribution process to maximize real-world security impact.

Technical Overview

SecureFi is built using modular smart contracts inspired by Octant's framework and the ERC-4626 tokenized vault standard.

• The YieldDonatingStrategy contract handles deposits, yield generation, and automatic minting of profits to a donation address, ensuring that all accrued yield flows transparently into the funding pool. It currently integrates with the Spark Vault to generate sustainable on-chain yield through low-risk DeFi strategies.

• The SecurityRouter contract manages the entire donation and distribution cycle. It collects the yield at the end of each epoch, verifies approved projects and bug reports from Cantina, and distributes funds to researchers based on a severity-weighted payout system.

• The architecture uses role-based access control via OpenZeppelin's AccessControl, and follows secure vault accounting with clear yield and withdrawal limits.

• All interactions - deposits, yield harvesting, and bug bounty payouts - are fully on-chain, auditable, and designed for minimal trust dependency.

This technical design ensures autonomous, transparent, and verifiable security funding, aligning incentives between depositors, projects, and researchers.

Why It Matters

SecureFi creates a regenerative security model for the Web3 ecosystem.
It empowers communities and DAOs to collectively fund security using DeFi yield, transforming passive capital into an active force for protection.

By aligning incentives between depositors, security researchers, and projects, SecureFi helps build a safer, more trustworthy Web3 environment, where every deposit contributes to preventing the next exploit.

Challenges we ran into

One of the biggest hurdles we faced was figuring out the right distribution and payout mechanisms for the generated yield. We wanted the donated yield to go toward funding bug bounties, but dedicating how to fairly distribute it across different bug severities and researchers turned out to be more complex than expected.

There wasn't a clear reference model we could follow, so we had to spend quite a bit of time researching existing platforms and payout structures - like those used by Cantina and Immunefi - to understand what makes a reward system both fair and transparent.

Even after exploring multiple options, we realized there's no one-size-fits-all solution. We finally designed a severity-weighted payout structure, where funds are allocated proportionally based on the impact of each vulnerability. It's still something we want to refine further, but getting to this version gave us a deeper understanding of how incentive mechanisms shape on-chain security systems.