> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ix.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Security model

> How IX RWA protects funds and data — the trust boundaries, the money-path invariant, and audit status.

Security is a precondition for real capital, not a feature added later. IX RWA's security model rests on one principle: **the blockchain is the source of truth, and every position and NAV figure is derived from verified on-chain events.**

## The money-path invariant

Ownership and value are never taken from what a client claims — they are read from the chain and verified before anything is recorded.

```mermaid theme={null}
flowchart LR
    U[User action] --> TX[On-chain deposit / redeem]
    TX --> EV[Vault event]
    EV --> CHK{Verified?<br/>sender, amount, event}
    CHK -->|yes| REC[Indexed into holder state]
    CHK -->|no| REJ[Rejected]
```

An event indexer reconstructs holder positions from on-chain `Deposit`/`Transfer` events (chain-as-truth), and NAV-per-share is recomputable from published on-chain inputs. This invariant gates the transition to real money.

## Proof of Reserve

NAV can only move through a recorded attestation. The NAV oracle's `ORACLE_UPDATER_ROLE` is assigned to the **AttestorRegistry** so that, once the direct-EOA write is revoked — a pre-mainnet lockdown step — no key can write NAV directly.

```mermaid theme={null}
flowchart LR
    A[Attestor · ATTESTOR_ROLE] -->|attestReserve · value + evidenceHash| AR[AttestorRegistry]
    AR -->|setCohortValue| O[NAV Oracle]
    O -->|bounds + staleness checks| O
    O --> V[IX-CORE vault prices off NAV]
```

Every move is on record as `(attestor, valueUSD, evidenceHash, timestamp)`. The oracle then applies its **own** guards to the pushed value, so a bad attestation still reverts on-chain.

<Note>
  **Honest boundary:** the registry enforces the process, not the truth of the evidence. Independent proof-of-reserve still requires a real third-party attestor holding `ATTESTOR_ROLE` and a real evidence pack (invoices, serials, site, telemetry) behind each `evidenceHash`. On testnet the attestor is the EconomicsFeeder key and the direct-EOA oracle write has not yet been revoked; on mainnet real attestors are added and every EOA path is revoked — same code. See [Proof of Reserve](/protocol/proof-of-reserve).
</Note>

## Oracle guards

The NAV oracle runs two guards, unchanged from testnet to mainnet:

| Guard         | Parameter | Effect                                                                                                                                                                                     |
| ------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Bounds**    | `maxBps`  | A single update can't move a cohort value by more than `maxBps` of its previous value. Zeroing a live cohort is blocked — removal is done via registry **quarantine**, never a value of 0. |
| **Staleness** | `maxAge`  | If `now − lastUpdate > maxAge`, `isStale()` is true and the vault **reverts deposits/redeems** (`NavStale`) until a fresh push arrives. A never-updated oracle reads stale (fail-safe).    |

## Redemption safety

A liquid share token can't be allowed to bank-run illiquid hardware:

* **Reserve floor** — instant redemptions are capped at `availableCash = balance − reserveFloor`; the floor is reachable only by the queue processor.
* **FIFO queue** — larger exits burn now and queue, paid in order once the vault balance plus smoothing reserve can cover the head (`processQueue` by a keeper, or user `claim`). FIFO fairness means the queue never skips ahead.

## Trust boundaries

| Layer                 | Control                                                                                                                                                                                                 |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Wallet / identity** | Non-custodial. Connecting a wallet is the only identity; IX RWA never holds your keys.                                                                                                                  |
| **Contracts**         | UUPS-upgradeable behind proxies; `UPGRADER_ROLE` moves to multisig / governance at Phase-2. `ReentrancyGuard` on all value-moving paths; `Pausable` admin stop. See [Governance](/security/governance). |
| **NAV / oracle**      | Priced only through the `INAVOracle` seam, written only by the AttestorRegistry, bounded and staleness-guarded.                                                                                         |
| **Roles**             | Least-privilege, separated: admin, attestor, oracle-updater, revenue-depositor, keeper, spender, upgrader — no single ambient owner.                                                                    |
| **Off-chain records** | Derived from verified on-chain events; reconciled against the chain.                                                                                                                                    |

## Audit status

<Warning>
  IX RWA is on **Base Sepolia testnet** with simulated settlement. A **third-party security audit** is a prerequisite for mainnet launch; results and the audit report will be published here. Until then, do not treat testnet as production-secure. See the [roadmap](/why-ix-rwa#roadmap) and the [Risk framework](/security/risk-framework).
</Warning>

## Responsible disclosure

If you believe you have found a vulnerability, please report it privately to the team rather than disclosing publicly. A formal disclosure policy and contact are published with the audit at launch.