ORRERY

Security

What holds, and what does not

The useful half of a security page is the second half. This one leads with it.

0Contracts deployed

On any network, testnets included.

0Audits completed

And none commissioned or scheduled.

0Bug bounties open

There is nothing yet to pay a bounty against.

6Known limits

Listed below, in full, unhedged.

Design guarantees

Properties the mechanism is built to have

These are claims about a design, not about deployed code. No line below has been verified by anyone, because there is nothing to verify yet.

Holds by construction

  • Non-custodialDeposits sit in the pool the hook manages. There is no operator balance and no address that can move a depositor’s assets.
  • Redemption is not gatedDetent — the emergency stop — halts deposits, rebalancing and routing. It does not halt redemption. A stop that traps holders is not a safety mechanism.
  • Parameters are published with boundsEvery governance-adjustable value has a hard range enforced in the contract, so a compromised vote has a floor and a ceiling rather than a blank field.
  • Price is derived, not assertedNAV is computed from pool state. Nobody publishes it and nobody can post a different one.

Does not hold yet

  • No auditNo contract has been reviewed by anyone. There is no auditor engaged, no report, and no bug bounty. Nothing is deployed to any network.
  • NAV marks at pool spotMint and redeem both price off the pool’s own price. Without a TWAP or a deviation band, a large enough single-block move is a mint-and-redeem attack. Specifying the guard is on the roadmap and is not done.
  • MEV is relocated, not removedTransit takes your order out of a public queue and gives it to a solver set. That set does not exist yet: no registration, no bonding, no minimum count, no anti-collusion rule. With one solver, "best price wins" is a tautology.
  • Composability is somebody else’s decisionEphemeris is usable as collateral only where a lending market lists it. No listing has been agreed, so treat "composable" as a property of the token’s shape, not of its acceptance.

Detent

A stop that traps holders is not a safety mechanism

What Detent halts

  • New deposits
  • Range rebalancing
  • Harvest and reinvestment
  • Intent routing and settlement

What it does not

  • Redemption stays open
  • Transfers of existing Ephemeris
  • Reading NAV
  • Withdrawal from the idle buffer

Disclosure

Reporting something

ReportpendingThere is no contract to report against yet. When there is, this section will carry an address, a key and a response window, and not before.
Scopethis siteToday the only thing in scope is this website — its build tooling, its generated pages and the claims on them. A wrong claim is a real defect here.
ResponsependingNo response-time commitment is published, because a commitment nobody is on call for is worse than none.

Known limits

The complete list

Not a selection. If something belongs here and is missing, that is a defect in this page and worth reporting.

  • No contract has been deployed, audited or formally verified.
  • NAV has no manipulation guard specified.
  • No solver set exists, so no MEV property currently holds.
  • Redemption under exhausted buffer has no specified rule.
  • Governance has no specified quorum, timelock or veto.
  • The tokenised-equity path is not specified, as distinct from not deployed.

Each of these in full on the Almanac