> ## Documentation Index
> Fetch the complete documentation index at: https://docs.solana.vanna.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and Protocol Controls

> What the Solana program actually enforces. Not an audit certificate.

This page lists controls in source. It does not certify a firm audit or a bounty.

## Program controls

| Control                | Scope                                        |
| ---------------------- | -------------------------------------------- |
| PDA seeds + bumps      | Every protocol account                       |
| Two-step admin         | `propose` / `accept`                         |
| Operating modes        | Pause borrows or halt                        |
| Measured transfers     | Never trust the requested amount alone       |
| Accounted reserve cash | Donations do not inflate vTokens             |
| Full-set health scan   | Borrow, withdraw, swap, Lite, liquidate      |
| Pyth gates             | Feed id, age, confidence, owner              |
| Share rounding         | Against the taker (lender down, borrower up) |
| 1.10 threshold         | Strict inequality                            |
| Lite allowlist         | Only admin-registered Kamino accounts        |
| Token-2022 fees        | Deltas, not requested amounts                |
| Close factor 50%       | Partial liquidation                          |

## Application

Wallet adapter / Privy signs. Faucet and fork oracle refresh are **demo privileges**. Do not ship those cheatcodes on public mainnet RPC.

## What to read

* `Protocol_V1_Solana/programs/vanna_lending/src/tests/test_security.rs`
* Internal reports in the protocol repo, on their own terms
* [Review Scope](/developers/review-scope)