Audit & Security Disclosure

Last updated: October 2025

1. Purpose of This Disclosure

The ORBT Protocol operates entirely on decentralized smart contracts deployed on public blockchains. This Audit & Security Disclosure outlines the Protocol’s approach to code security, audits, and risk management. It is provided for transparency only and does not constitute any warranty, guarantee, or assurance of safety or performance.

2. Security Philosophy

The ORBT Protocol’s codebase is designed for maximum transparency and defense-in-depth. Security is not a one-time milestone. It is a living process embedded into every stage of protocol development.

Key principles include:

• Open-source transparency: All core contracts are publicly verifiable on-chain and through official repositories.

• Defense-in-depth architecture: Every subsystem (vault, pocket, allocator, governance module) operates under an isolation model with minimal permissions. If one component fails or is exploited, the impact remains localized and cannot compromise user funds or unrelated modules.

• Iterative verification: Automated regression testing is performed on all protocol updates to detect unexpected behavior before deployment.

• Community participation: Governance and security reviews are community-led, with audits of proposed protocol upgrades conducted prior to execution.

Through this layered, adaptive security model, ORBT aims to achieve institutional-grade robustness with full open-source transparency.

3. Audit Program Structure

Every core contract, including UCE, Pockets, allocator, and governance modules, undergoes multiple independent audits by leading blockchain security firms such as Trail of Bits, Certora, and OpenZeppelin. Audits are designed to assess the correctness, security, and upgradability of the codebase. ORBT’s multi-phase audit approach includes:

• Architecture and Design Review: Holistic review of protocol architecture, cross-module permissions, and dependency isolation.

• Smart-Contract Code Audit: Formal review of implementation by independent audit partners.

• Economic / Financial Risk Audit: Evaluation of reserve mechanisms, peg stability, and treasury yield logic by quantitative risk specialists.

• Public Audit & Bug Bounty: Continuous peer review through the Immunefi platform and community programs.

• Re-Audit and Iterative Testing: Audits are re-run after significant upgrades, migrations, or parameter changes.

4. Publication of Audit Results

Audit reports are published publicly, ensuring accountability and traceability of every change. Each report specifies the auditor, audit scope, and summary of findings. Users are encouraged to verify audit status and report links via the official ORBT documentation portal or repositories before interacting with new deployments.

5. Bug Bounty and Community Reporting

The ORBT Protocol maintains a permanent bug bounty program through platforms such as Immunefi, incentivizing responsible disclosures from security researchers and white-hat hackers.

• Rewards: High-severity vulnerabilities may receive bounties (to be released soon), depending on impact and exploitability.

• Continuous operation: The program remains open indefinitely, even after audits, ensuring ongoing peer review and real-time protection.

• Responsible disclosure: Participants are required to submit reports privately via designated channels to avoid public exposure of critical vulnerabilities before fixes are deployed.

6. Continuous Security Process

Security at ORBT is continuous and adaptive. In addition to formal audits and bug bounties, the Protocol implements:

• Automated regression testing on all updates and parameter changes.

• On-chain monitoring to detect anomalous contract behavior.

• Community-led governance audits reviewing all upgrade proposals before execution.

• Rapid-response patching workflows coordinated among core contributors and verified maintainers.

These measures ensure that ORBT evolves securely in real time without compromising decentralization or transparency.

7. Limitations of Audits and Disclosures

Audits and bug-bounty programs are powerful mitigations but cannot eliminate all risks. Users should understand that:

• Even audited contracts may contain undiscovered vulnerabilities.

• Economic or governance parameters may change after an audit’s completion.

• Interaction with third-party protocols, bridges, or chains introduces additional risks outside ORBT’s control.

• Exploits, network congestion, or unexpected market conditions can still result in partial or total loss of funds.

• Engagement with the Protocol remains entirely at the user’s own risk.

8. User Security Responsibilities

Users must:

• Interact only with official contract addresses published by the ORBT documentation portal or verified repositories.

• Verify addresses independently on-chain before sending transactions.

• Maintain strict security over private keys, wallets, and connected devices.

• Report any suspected vulnerabilities through responsible-disclosure channels.

9. Disclaimer of Liability

To the maximum extent permitted by applicable law, the ORBT Protocol and its contributors disclaim liability for any losses arising from vulnerabilities, exploits, economic failures, or other security incidents, even if such issues occur in audited components. Use of the Protocol constitutes acknowledgment and acceptance of these risks.

10. Transparency Commitment

The ORBT Protocol is committed to continuous transparency and accountability. Future audits, re-audits, bounty updates, and economic-risk assessments will be published promptly through official channels, ensuring users have the latest information before engaging with the system.