Security & risk

Read this before you deposit.

LPing carries risk of loss. Providing liquidity is not risk-free. You can lose money.

Smart-contract risk exists. Code can have bugs. Formal verification and testing reduce risk — they do not eliminate it.

No third-party audit has been done yet. We have not engaged an audit firm. What we have instead is machine-checked proofs of the core math and differential testing against an independent 60-digit reference implementation — see the matrix below for exactly what that does and does not cover.

Do not deposit more than you can afford to lose. No yields are promised. There is no token and no airdrop.

What's verified — and what isn't.

Honesty is the product. Here's the real matrix.

LayerStatusHow
Core math (exact split, dimension reduction)✓ Formally verifiedLean 4, zero sorry, standard axioms
Solidity numerics / rounding✓ Differential-testedBit-for-bit vs a 60-digit mpmath oracle · 2,699 assertions
Runtime invariants (F ≤ 0, band, solvency, claims)✓ FuzzedStateful invariant campaign, asserted after every call (I1–I9)
Full contract (all paths, economic edge cases)— Not auditedNo audit firm engaged yet; mainnet is gated on this
Economic / oracle assumptions, keeper liveness, guardian trust— Stated, not eliminatedMinimized and documented below — not removed

Who can act on the pool.

The trust surface is deliberately small and auditable. Here's exactly who can do what, and why.

Anyone (keeper)
Freezing a depegged asset is permissionless — any keeper can trip the freeze when the swappable TWAP freeze-trigger's condition is met, so quarantine doesn't wait on a privileged party. freeze() / poke()
Guardian
A guardian can act fast in an emergency (e.g. freeze) so the pool doesn't have to wait for the timelock when a stable is actively breaking. It cannot move funds arbitrarily.
Owner + timelock
The irreversible step — settle (realizing a quarantined asset) — sits behind an owner queue → timelock → execute flow. No instant, unilateral settlement. queueSettle → settle
Freeze-trigger oracle
The depeg condition is read from a swappable TWAP-based freeze-trigger (interface-stubbed, replaceable), separate from any pricing. We distinguish the reference oracle (is it depegged?) from the pool's own implied price.

Full mechanism: SPEC §7 (lifecycle) and §9 (governance). Contracts are open and verified on-chain at launch.

Known limitations (v1).

Being first to list your own limits is a credibility flex. From SPEC §8.5:

Bug bounty & responsible disclosure

A bug bounty goes live at launch. If you find something, tell us privately first — we operate under safe-harbor for good-faith research. Please don't test on mainnet funds or publicly disclose before a fix.

security@spherra.xyz · PGP key on request

Audit status

Not audited. No firm is engaged yet. We will not deploy to mainnet without one; when a report exists it will be embedded here, and this page (plus the proofs page) will name the firm and link it. Until then, treat the verification we have done as exactly what it is — proofs of the math, not a review of the deployment.

Status: not started · firm: none engaged · report: none

Contracts & addresses

Verified source and mainnet addresses will be published here at launch. Until then, everything is in the public repo.

OrbitalPool: — published at mainnet —
FreezeTrigger: — published at mainnet —
Chain / network: — announced at mainnet —

Open the repo →