Skip to main content
Security is a precondition for real capital, not a feature added later. IX RWA’s security model rests on one principle: the blockchain is the source of truth, and every position and NAV figure is derived from verified on-chain events.

​
The money-path invariant

Ownership and value are never taken from what a client claims — they are read from the chain and verified before anything is recorded. An event indexer reconstructs holder positions from on-chain Deposit/Transfer events (chain-as-truth), and NAV-per-share is recomputable from published on-chain inputs. This invariant gates the transition to real money.

​
Proof of Reserve

NAV can only move through a recorded attestation. The NAV oracle’s ORACLE_UPDATER_ROLE is assigned to the AttestorRegistry so that, once the direct-EOA write is revoked — a pre-mainnet lockdown step — no key can write NAV directly. Every move is on record as (attestor, valueUSD, evidenceHash, timestamp). The oracle then applies its own guards to the pushed value, so a bad attestation still reverts on-chain.
Honest boundary: the registry enforces the process, not the truth of the evidence. Independent proof-of-reserve still requires a real third-party attestor holding ATTESTOR_ROLE and a real evidence pack (invoices, serials, site, telemetry) behind each evidenceHash. On testnet the attestor is the EconomicsFeeder key and the direct-EOA oracle write has not yet been revoked; on mainnet real attestors are added and every EOA path is revoked — same code. See Proof of Reserve.

​
Oracle guards

The NAV oracle runs two guards, unchanged from testnet to mainnet:

​
Redemption safety

A liquid share token can’t be allowed to bank-run illiquid hardware:
  • Reserve floor — instant redemptions are capped at availableCash = balance − reserveFloor; the floor is reachable only by the queue processor.
  • FIFO queue — larger exits burn now and queue, paid in order once the vault balance plus smoothing reserve can cover the head (processQueue by a keeper, or user claim). FIFO fairness means the queue never skips ahead.

​
Trust boundaries

​
Audit status

IX RWA is on Base Sepolia testnet with simulated settlement. A third-party security audit is a prerequisite for mainnet launch; results and the audit report will be published here. Until then, do not treat testnet as production-secure. See the roadmap and the Risk framework.

​
Responsible disclosure

If you believe you have found a vulnerability, please report it privately to the team rather than disclosing publicly. A formal disclosure policy and contact are published with the audit at launch.