Security
What holds, and what does not
The useful half of a security page is the second half. This one leads with it.
0Contracts deployed
On any network, testnets included.
0Audits completed
And none commissioned or scheduled.
0Bug bounties open
There is nothing yet to pay a bounty against.
6Known limits
Listed below, in full, unhedged.
Design guarantees
Properties the mechanism is built to have
These are claims about a design, not about deployed code. No line below has been verified by anyone, because there is nothing to verify yet.
Holds by construction
- Non-custodialDeposits sit in the pool the hook manages. There is no operator balance and no address that can move a depositor’s assets.
- Redemption is not gatedDetent — the emergency stop — halts deposits, rebalancing and routing. It does not halt redemption. A stop that traps holders is not a safety mechanism.
- Parameters are published with boundsEvery governance-adjustable value has a hard range enforced in the contract, so a compromised vote has a floor and a ceiling rather than a blank field.
- Price is derived, not assertedNAV is computed from pool state. Nobody publishes it and nobody can post a different one.
Does not hold yet
- No auditNo contract has been reviewed by anyone. There is no auditor engaged, no report, and no bug bounty. Nothing is deployed to any network.
- NAV marks at pool spotMint and redeem both price off the pool’s own price. Without a TWAP or a deviation band, a large enough single-block move is a mint-and-redeem attack. Specifying the guard is on the roadmap and is not done.
- MEV is relocated, not removedTransit takes your order out of a public queue and gives it to a solver set. That set does not exist yet: no registration, no bonding, no minimum count, no anti-collusion rule. With one solver, "best price wins" is a tautology.
- Composability is somebody else’s decisionEphemeris is usable as collateral only where a lending market lists it. No listing has been agreed, so treat "composable" as a property of the token’s shape, not of its acceptance.
Detent
A stop that traps holders is not a safety mechanism
What Detent halts
- New deposits
- Range rebalancing
- Harvest and reinvestment
- Intent routing and settlement
What it does not
- Redemption stays open
- Transfers of existing Ephemeris
- Reading NAV
- Withdrawal from the idle buffer
Disclosure
Reporting something
ReportpendingThere is no contract to report against yet. When there is, this section will carry an address, a key and a response window, and not before.
Scopethis siteToday the only thing in scope is this website — its build tooling, its generated pages and the claims on them. A wrong claim is a real defect here.
ResponsependingNo response-time commitment is published, because a commitment nobody is on call for is worse than none.
Known limits
The complete list
Not a selection. If something belongs here and is missing, that is a defect in this page and worth reporting.
- No contract has been deployed, audited or formally verified.
- NAV has no manipulation guard specified.
- No solver set exists, so no MEV property currently holds.
- Redemption under exhausted buffer has no specified rule.
- Governance has no specified quorum, timelock or veto.
- The tokenised-equity path is not specified, as distinct from not deployed.