Trust assumptions
What you are trusting
No review removes these. They are properties of the design, stated so that you can weigh them.
The contracts are upgradeable
Core contracts are UUPS proxies, so their logic can be replaced. Upgrades of the eight core proxies are scheduled through an OpenZeppelin TimelockController with a 12-hour delay. The oracle, fee and price-storage contracts upgrade without that delay, a deliberate choice so they can be fixed quickly in an incident.
Check it: Timelock on Basescan · Security guide: access control
The active price feed is published by an off-chain service
The active EUR/USD reference is published from Hyperliquid by a Quantillon-operated service. The market oracle checks freshness, bounds, deviation and an independent Chainlink reference on-chain. Chainlink is also a manual governance fallback; selecting it does not alone restore minting. Normal user amounts additionally depend on directional execution pricing and admitted hedge capacity.
Check it: Oracle architecture
On chain
Governance contracts
Read their configuration and history directly, rather than taking a description of it on trust.
- Access-control model
- Security guide, including known limitations
Roadmap
Toward independent review
Bug bounty: planned, not funded
A paid bug bounty is intended once a ring-fenced reward budget is available. It has not launched, and reports submitted under the current disclosure programme are not eligible for monetary rewards.
External review: intended, not yet funded
An external review by an independent firm or a public audit contest is intended once it can be funded. When one is commissioned, its scope and its report will be published here.