Security
This section describes how Orion handles security publicly: how to report issues, where audit reports live, which trust assumptions the protocol makes, and how incidents are communicated.
Internal runbooks, tooling, and signer operations are not published here.
Report privately
Do not open a public GitHub issue for a suspected vulnerability. Email security@orionfinance.ai.
Vulnerability Disclosure
Send reports to security@orionfinance.ai. Include enough for us to reproduce the issue:
- A short description of the suspected vulnerability
- Affected contracts, networks, or app surfaces, if known
- Steps or transactions that demonstrate the issue
- A way to reach you
Do not exploit the issue on production deployments, and do not share a working exploit publicly before we have had a chance to respond.
We aim to acknowledge reports and to coordinate any public disclosure so that users are not put at further risk. Acknowledgement, severity, and any discretionary recognition are decided case by case. This page is not a bug-bounty program and does not promise payment.
For user-facing safety (official app URL, wallet hygiene), see User Security.
Third-party Audits
Independent audit reports for core protocol contracts are published in the protocol repository: Security Audits.
Audits reduce, but do not eliminate, smart-contract and integration risk. See Risks.
Security Assumptions
Using Orion means accepting these conditions. They are stated here so they are explicit, not so they can be removed.
- Admin is trusted. Protocol Admin is
OrionConfig.owner(), held by a multi-signature Gnosis Safe. A compromised or malicious Admin can cause severe damage. See Roles and Permissions. - Guardian is an emergency brake, not a recovery guarantee. Guardian may pause the Liquidity Orchestrator and retune a small set of emergency parameters. Guardian cannot unpause. Pause does not restore lost funds.
- Users custody their own keys. Orion does not hold wallet keys. Phishing, malware, and mistaken transactions are user-side risks.
- Integrations can fail. Execution, pricing, and yield depend on third-party protocols and oracles. Those systems can bug, halt, or be exploited.
Upgradeable contracts may be placed behind an upgrade timelock after it is set. Until then, Admin bootstraps that control. Details are in Roles and Permissions.