How Zest Protocol designs, tests and audits Stacks Pools, and which contracts each audit covers.

Security-First Design

Stacks Pools follow the same fail-closed philosophy as the rest of Zest Protocol:

• Exact asset allowances: every payout runs with an allowance for exactly the token and amount being paid, so a token’s own code cannot move any other asset the pool holds
• Measured transfers: every transfer in and out of a pool is checked against the balances it changed; a token that under-delivers fails the transaction instead of leaving the pool short
• Pool-favoring rounding: every output rounds down and every amount owed to the pool rounds up, so no trade, deposit or withdrawal can extract value through rounding
• First-deposit locks: the first deposit into every concentrated liquidity bin locks 1,000 shares permanently, which makes share-price manipulation in a near-empty bin expensive
• Exits that cannot be paused: no pause, sunset or governance action stops a liquidity provider from withdrawing
• No upgrades: the pool contracts have no proxy or upgrade hook; a new version is a new deployment that liquidity moves to voluntarily

Testing

Concentrated liquidity pools are checked by an exact rational model of the bin mathematics, a property fuzzer, model-generated differential vectors, Z3 proofs of the pool’s arithmetic lemmas, stateful fuzzing of the contracts with independent invariants, and adversarial review with proof-of-concept tests against hostile tokens. The bin mathematics is specified and proved in the Zest Protocol CLMM whitepaper.

Liquidity Vaults are checked against a reference model of the manager fee split, with vectors generated from it, and by tests of full and partial exits, roles, deadlines, hostile tokens and execution costs at 64 bins.

Audits

Every Stacks Pools contract has been independently audited. See Audit Scope for the contracts in each product.

Concentrated Liquidity Pools and Liquidity Vaults

The concentrated liquidity contracts, the Liquidity Vault contracts and their governance were audited together by Clarity Alliance , a Clarity smart-contract security firm. The report lists every finding with its severity and whether it was resolved or acknowledged.

Auditor	Scope	Report
Clarity Alliance	clmm-pool-v1, clmm-router-v1, clmm-lp-token-v1, clmm-vault-public-v1, clmm-vault-batch64-v1, bootstrap, executor-dao, operators	Zest Protocol CLMM Security Review , November 2, 2026

Audit Scope

Product	Contracts
Concentrated liquidity pools	clmm-pool-v1, clmm-router-v1, clmm-lp-token-v1, bootstrap, executor-dao, operators
Liquidity Vaults	clmm-vault-public-v1, clmm-vault-batch64-v1

Bug Bounty

The Zest Protocol CLMM contracts are in scope of Zest Protocol’s bug bounty program on Immunefi . If you find a security issue in one of them, please report it there rather than disclosing it publicly.