Skip to content

Audits

ARKONIX runs an ongoing, independent security program with Halborn Security, structured as complementary engagements rather than a one-off audit.

External penetration testing (black-box)

Testing of the live production and staging surfaces exactly as an external attacker sees them — no source code or infrastructure access provided. Scope includes:

  • The financial attack surface first — can an external actor submit, trigger, or manipulate on-chain transactions (trades, rebalances, deposits, redemptions) or privileged operations (epoch approval, vault deployment, policy changes) without authorization?
  • Authentication & authorization — JWT validation and rotation handling, token tampering, role escalation, and cross-tenant isolation (IDOR) across partner accounts and vaults.
  • Wallet sign-in (SIWE / EIP-4361) — nonce replay, domain and chain-id binding, expiry validation, cross-origin sign-in abuse.
  • Partner API request signing (HMAC) — signature replay windows, nonce reuse, signature scope coverage, timing-attack resistance, key confusion across partners.
  • Application security — OWASP Top 10 across the depositor app, partner portal, and white-label deployments.
  • Business logic — deposit/redeem flow manipulation and ERC-7540 epoch-workflow bypass attempts.
  • Exposure & perimeter — internet-accessible internal services, secrets leakage in responses and client bundles, rate limiting and application-layer DoS, DNS/subdomain takeover and TLS configuration.
  • Supply chain (external surface) — dependency-confusion and typosquat risk on the published npm SDK, integrity of third-party frontend assets.

Source-level review (white-box)

A separate engagement with full code and infrastructure access, covering the backend execution platform, protocol contracts, and supporting services — including the smart-contract layer excluded from black-box scope.

Third-party foundations

The vault contract system builds on Centrifuge Protocol v3, which maintains its own extensive audit history — the core contracts are an unmodified fork, so upstream audits apply directly. Centrifuge publishes its security reviews at docs.centrifuge.io → Protocol Security. See Smart Contracts for the fork framing and the Arkonix-specific extensions. Provider-side security of managed services (auth provider, cloud platform, RPC providers) is covered by those vendors' own programs and certifications.

Reports

Audit summaries and letters of engagement are available on request — contact info@arkonix.xyz.

Note

No audit makes a system risk-free. The program above reduces and surfaces risk; the custody model bounds the blast radius of any single failure by keeping user funds outside platform custody.