Security Architecture

1. Audit Summary

Auditor	Type	Scope	Status
SolidProof	Smart contract audit	Token contract, staking vault	Completed
Cyberscope	Smart contract audit	Full contract suite	Completed
Spywolf	Smart contract audit	Full contract suite	Completed
Spywolf	KYC verification	Core team identity	Completed

Check this section to view the audit reports Security & Audits

2. Attack Surface Analysis

Rug-Pull Mitigations:

• Mint authority revoked at TGE → no new token creation
• Freeze authority revoked at TGE → user funds cannot be frozen
• Liquidity locked post-TGE → team cannot drain DEX pools
• Team tokens vested → no immediate large sell pressure

Smart Contract Risk Mitigations:

• Two independent audits before deployment
• Program upgrade authority held by multisig, no single key can push malicious upgrade
• Upgrade time-lock proposed for post-launch governance (community can audit proposed upgrades before execution)

Oracle / Price Feed Risk:

• Commerce Protocol and yield calculations do not rely on external price oracles for core logic
• Where price feeds are needed (e.g., fiat-equivalent valuation), aggregated feeds from multiple sources with outlier rejection

3. Treasury & Team Wallet Controls

• Treasury: M-of-N multisig, requires multiple signers for any outbound transaction
• Team allocation: Time-locked vesting contract, linear release over vesting schedule
• Marketing wallet: Separate multisig with defined spend categories