> ## Documentation Index
> Fetch the complete documentation index at: https://whitepaper.rwanftfi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & Audit

> RWANFTFI smart contracts are independently audited by CertiK (final report April 28, 2026), layered with three-level account security, single-use TAN codes, separate financial password, and 2FA via the Telegram bot.

<CardGroup cols={1}>
  <Card title="Audited by CertiK" icon="shield-check">
    The RWANFTFI smart contracts have been independently audited by **CertiK**. Final report published **April 28, 2026** — full PDF below, and on the public [CertiK Skynet directory](https://skynet.certik.com/projects/rwanftfi).
  </Card>
</CardGroup>

CertiK is one of the longest-established security firms in Web3 and audits a significant share of the major protocols in the space. The audit was conducted using their standard methodology — Static Analysis, Manual Review, and Formal Verification — and the full report is published publicly, both on this page and on CertiK's own Skynet directory.

## How can I verify the audit report?

You have three independent ways to interact with the audit. The point isn't to give the same thing three times — it's so there is no doubt the version on this page matches the version CertiK itself publishes, and so the report is accessible regardless of device.

<CardGroup cols={3}>
  <Card title="Inline Preview" icon="eye">
    Read the full PDF directly on this page. Best in desktop browsers.
  </Card>

  <Card title="Download PDF" icon="download" href="https://app.rwanftfi.com/security">
    Save the original report to your device. Recommended on mobile.
  </Card>

  <Card title="CertiK Skynet" icon="up-right-from-square" href="https://skynet.certik.com/projects/rwanftfi">
    Verify the report on CertiK's own public directory.
  </Card>
</CardGroup>

<object data="https://cdn.jsdelivr.net/gh/rwanftfi-art/rwanftfi-docs@master/CertiK-RWANFTFI-Audit.pdf" type="application/pdf" aria-label="CertiK Audit Report — RWANFTFI" style={{ width: '100%', height: '720px', border: '1px solid rgba(255,255,255,0.1)', borderRadius: '12px', marginTop: '24px', marginBottom: '8px', backgroundColor: 'rgba(255,255,255,0.02)' }}>
  <div style={{ display: 'flex', flexDirection: 'column', alignItems: 'center', justifyContent: 'center', textAlign: 'center', padding: '32px', gap: '12px' }}>
    <div>Inline PDF preview is not supported in this browser.</div>

    <a href="https://cdn.jsdelivr.net/gh/rwanftfi-art/rwanftfi-docs@master/CertiK-RWANFTFI-Audit.pdf" style={{ display: 'inline-block', padding: '10px 18px', borderRadius: '8px', border: '1px solid rgba(255,255,255,0.2)', textDecoration: 'none' }}>
      Open the audit report (PDF)
    </a>
  </div>
</object>

<Info>
  **On Safari and most mobile browsers** the inline preview may not render — those browsers do not embed PDFs directly. Use the **Download PDF** button (or the link inside the preview area) to open the report on your device.
</Info>

## How are accounts protected at the application layer?

The audit covers the on-chain smart contract layer. At the application layer, user accounts are additionally protected by several independent mechanisms:

<CardGroup cols={2}>
  <Card title="Three-Level Security" icon="layer-group">
    Tiered protection separating login, financial actions, and high-value operations.
  </Card>

  <Card title="TAN Codes" icon="key">
    Single-use Transaction Authentication Numbers required for every financial transaction.
  </Card>

  <Card title="Financial Password" icon="fingerprint">
    A password separate from your login credentials, required only for moving funds.
  </Card>

  <Card title="2FA + Telegram Bot" icon="telegram">
    Standard two-factor authentication, plus action verification through the official Telegram bot.
  </Card>
</CardGroup>

<Info>
  **Transactions require a Web3 wallet.** You can sign in to the dashboard with email and password to view your data, but executing any financial action requires a connected Web3 wallet (MetaMask, Trust Wallet, or another EVM-compatible wallet).
</Info>

<Warning>
  **Beware of impersonators.** RWANFTFI staff will never contact you first, never ask for your private keys or seed phrase, and never request payments outside the official platform. Always verify you are on **rwanftfi.com** before connecting your wallet or entering credentials.
</Warning>