Security
Security posture, stated plainly
Every contract passes a structured pre-deploy security review before mainnet. Signing authority is kept off any machine an automated agent can write to. This page tracks that posture and how to report an issue.
How is contract code reviewed before deploy?
Through a mandatory pre-deploy security review covering the three runtimes the platform ships: Solidity/EVM, Rust/WASM (the native L1), and XRPL C Hooks. The review is structured — scope, threat model, a per-platform vulnerability checklist, invariant and property testing, and a severity-rated report. It covers reentrancy, integer over/underflow, access control, oracle manipulation, front-running/MEV, delegatecall and tx.origin misuse, unchecked external calls, WASM nondeterminism and fuel exhaustion, and XRPL Hook guard/state/reserve pitfalls. A licensed external audit is required before any high-value mainnet launch.
How is signing-key material protected?
By separation. Private keys, seed phrases, and custodian credentials are kept off any machine that an automated agent — including internal AI agents — can write to. Consolidation and refactoring tooling never runs next to a hot key. Tenants hold their own backup keys; Unykorn does not custody them.
What is the audit status per component?
| Component | Runtime | Status |
|---|---|---|
| ERC-3643 token + compliance modules | Solidity/EVM | internal review |
| Native L1 state engine | Rust/WASM | internal review |
| XRPL lending hooks | XRPL C Hooks | internal review |
| External third-party audit | all | planned |
Status labels are updated as reviews complete. An external report is published here in full once obtained — a published mid-tier audit converts diligence better than any homepage copy.
How do I report a vulnerability?
Email [email protected] with a description and reproduction steps. Please practice coordinated disclosure and allow reasonable time to remediate before any public write-up. A formal bug-bounty scope is planned and will be published on this page.