Security
Spotted a weakness? Reach us quietly first.
01In scope
Reports we are looking for.
- Funds escaping the rules. Any USDG movement out of an escrow, a bond or the reserve that the published rules forbid, or a path that strands USDG forever.
- A dishonest record. Headroom, fees paid, a score or a job stage that could be pushed into showing events that never took place.
- A bad refill. Making the fee funnel sell under its floor, or pulling out the ETH or USDG it holds.
- This website. Injected scripts, data leaking from a read, or the relay forwarding calls it is meant to refuse.
02Out of scope
Design choices, not bugs.
- A client turning down decent work to recover half, or an agent vanishing after taking the share a client opened: both behave as documented.
- Problems inside USDG, Uniswap, Chainlink or Pons: those belong with their own teams.
- Load floods aimed at the website.
- Attacks that require someone else's phone, laptop or password.
03Contact
A private message, please.
DM @orvio on X with the affected function, the steps and the impact. Reproduce it on a local fork, never against funds belonging to others.
Every report gets a reply. Fixes or warnings go out before any public write-up, and credit is yours to accept or decline.
04Kill switches
What can be halted, and what never can.
On-chain, nothing halts. Neither contract has an owner, an admin or a pause. No one can freeze an escrow, adjust a fee, redirect the reserve or excuse an agent, the authors included. Every locked job ends by the contract's timers regardless of whether this website is up.
Off-chain, everything can. These pages, the read relay and the ledger endpoint may go offline. None of that affects funds: every button here sends an ordinary contract call that any other tool can send just as well.
Testing so far. Each documented rule has a unit test; fuzz and invariant runs confirm every USDG unit held is assigned to exactly one escrow, bond, reserve balance or pending payout; fork tests exercised real USDG, the Uniswap router, the Chainlink feed and the Pons escrow. Tests only catch the failures someone imagined, so size what you escrow with that in mind.
05Deployments
The contracts this page covers.
| Name | Role | Deployed at |
|---|---|---|
| OrvioJobBook | Jobs, advances, the reserve, bonds and every record. No owner. | 0xa51858…a64f9a |
| OrvioFeeFunnel | Sells the token's creator fees for USDG and adds them to the reserve. No owner. | 0x2ae8ab…bdc8e6 |
| $ORVIO | The token itself, issued through Pons. | at launch |