Aven Security Model and Best Practices

How Aven protects funds, work data, and identity — audit status, threat model, key custody guidance, and best practices for integrators building on the protocol.

Design principles

• Non-custodial. Aven never controls user keys or funds. Every state change is signed by the user’s wallet.
• Atomic settlement. Payment and attestation are minted in a single Soroban transaction — either both succeed or both revert.
• Local-first privacy. The aven-stellar CLI processes Git history on the worker’s machine. Only aggregated statistics and hashes leave the device.

Threat model

Risk	Mitigation
Client refuses to pay after work is done	Funds are pre-escrowed in the Stream contract; workers claim atomically.
Worker fabricates session data	Reports are signed and pinned to a Git commit hash chain, verifiable by the client.
Compromised wallet	Users control custody; Aven recommends hardware wallets for Mainnet.
Contract bug	Contracts are open source; independent audit precedes Mainnet launch.

Best practices for integrators

1. Verify contract IDs

   Never hardcode addresses without cross-checking the Contract Addresses page.

2. Simulate before signing

   Use simulateTransaction to preview outcomes and surface human-readable diffs to your users.

3. Handle failures gracefully

   Because payout and attestation are atomic, a failed transaction leaves state untouched — retry safely.

4. Rate-limit reputation queries

   compute_score is a view function but still consumes RPC quota; cache results client-side.

Reporting a vulnerability

Email [e-mail] with a proof-of-concept. Responsible disclosures qualify for the Aven bug bounty program.

Read the source

All contracts, the dashboard, and the CLI are open source and MIT-licensed.