[FEATURE] Define pre-mainnet security audit checklist and engage audit firm

[derbydaniels9-cpu]

Summary

There is no security audit process defined for the contracts. Deploying unaudited financial contracts to Stellar mainnet exposes user funds to smart contract vulnerabilities.

Recommended audit checklist before mainnet deployment

Arithmetic & Overflow

• All arithmetic uses checked operations (Soroban SDK integers panic on overflow by default in debug mode — verify release mode behavior)
• No division before multiplication in fee calculations
• Interest calculation uses integer arithmetic, not floating point

Access Control

• All admin functions verify admin.require_auth()
• Admin address is stored in contract storage, not hardcoded
• No function allows arbitrary address to call privileged operations

Reentrancy

• State is updated before any external token transfers (checks-effects-interactions pattern)
• No callbacks or cross-contract calls that could reenter deposit/withdraw

Denial of Service

• No unbounded loops over user storage
• Contract cannot be bricked by sending 0-amount deposits

Economic Attacks

• Penalty rate cannot be set to 100% by admin
• Interest rate has an on-chain maximum cap
• Flash loan attacks not possible (Soroban does not have flash loans, but verify)

Recommended audit firms

• OtterSec (Soroban specialists)
• Trail of Bits
• Halborn

Files affected:

• New: SECURITY.md
• New: audits/ directory