> For the complete documentation index, see [llms.txt](https://docs.superlend.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.superlend.xyz/products/vaults/high-yield-vaults/security.md).

# Security

High Yield Vaults are built with security as a core principle. They use audited, battle-tested components and a modular design that minimizes custom logic and reduces attack surface.

***

### **Security Design**

High Yield Vaults follow a modular architecture where each operation is isolated and clearly defined.

Key principles include:

* Protocol-Native Integrations\
  Looping strategies rely on audited lending protocols, flash loans, and decentralized exchange infrastructure rather than custom execution logic.
* ERC-4626 Vault Standard\
  High Yield Vaults follow the ERC-4626 tokenized vault standard, ensuring predictable accounting and transparent share-to-asset conversions.
* Modular Architecture\
  Borrowing, looping, and unwinding are implemented as independent modules, reducing complexity and limiting blast radius in the event of an issue.
* Minimal Custom Logic\
  Superlend adds only the automation and configuration required to manage leverage. Core operations rely on well-tested external protocols.

***

### **Risk Controls**

The vault enforces risk parameters at the smart contract level, including:

* Loan-to-value (LTV) limits
* Liquidation thresholds
* Maximum leverage caps

These controls are designed to help prevent unsafe positions, but they do not eliminate risk.

***

### **User Safety Guarantees**

* Permissionless Withdrawals\
  Users can withdraw or unwind positions at any time. The vault handles deleveraging automatically when required.
* Non-Custodial Design\
  Funds remain in non-custodial smart contracts at all times. Superlend never takes direct custody of user assets.

***

### **Audits & Reviews**

All core High Yield Vaults contracts and strategy logic have been audited by [Sherlock](https://sherlock.xyz/) prior to deployment.

In addition:

* Internal security reviews are conducted before releases
* Protocol dependencies are reviewed before integration
* Modules are monitored continuously after launch

{% file src="/files/0EiDbmmUM98YR6slmMAz" %}

{% file src="/files/wLU1dwv3CmpXIRqnYazg" %}

### **Important Reminder**

While security best practices and audits reduce risk, leveraged strategies remain inherently complex. Users should understand the mechanics and risks before depositing.

For more detail on how leverage works, see **How It Works**.