Security
How ARKZ protects the contracts it runs and the accounts that hold them, where the audit reports are published, and how to report a problem.
Reporting a vulnerability
The address for vulnerability reports is not published yet. It appears here as soon as ARKZ publishes it.
A good report names the contract and the function, the network and the address when the contract is deployed, the impact, and the smallest reproduction you have. A Foundry test is ideal. Please do not report a suspected vulnerability in a public issue, post or discussion.
Audits
No audit report is published yet. Each report is listed here when it is published.
An audit covers the public set of contracts listed under Contracts, at the addresses the deployment records list. The libraries the contracts build on are reported to their own maintainers.
How the contracts are protected
- Nothing is upgradeable. Deployed code never changes.
- A timelock holds the admin roles, so every change of role or setting waits 48 hours in public.
- Operational keys are separate, each with one job, and the deploy rehearsal checks who holds each role.
- Contracts that move value can be paused while an incident is examined.
- Noncustodial by design. Wallet phrases and signing stay on your device or in your own wallet. A purchase needs a destination you control before payment, and ARKZ never holds funds at its own discretion.
How your account is protected
- A six-digit PIN, and your second factor when you have one, for every change of identity. See Account and Passport.
- A Passport moves only with your signature, your PIN and a separate approval, after a 24-hour wait you can cancel.
- A change of account email sends an undo link to the old address.