Security and contracts
Orvyn’s contracts hold real USDG on Robinhood Chain. This page lists them, what each key can and cannot do, how the code was tested, and what is not in place.
Status
- Unaudited. No third party has audited the contracts. Read them as unaudited code that holds funds, and size any exposure to that.
- One owner key. There is no multisig and no timelock. What limits the key is what the contracts let it do, below.
- Not upgradeable. What the contracts do is what was deployed on 21 September 2026.
Contracts and keys
On Robinhood Chain, chain id 4663.
| Contract or key | Address | What it does |
|---|---|---|
| OrvynRegistry | 0x1Fd5CDDBCA88Ccf92507A0E21cd487D9842a1F7c | Providers, feeds, signers and fee terms. Deploys provider vaults |
| OrvynVerifier | 0x684482efbC4F169679b067f6A58700Af453D08fa | Checks a signed report against the registry |
| OrvynVault implementation | 0xbEec7811bc64961290D041B7c8eDEd651b1a9dCD | The code every provider vault runs. A vault has no owner and no operator |
| USDG | 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168 | The asset every price and payment is in. Issued by a third party |
| Treasury | 0x89F9ca9E51c7E2d32c6053C9D31C4188F123fE08 | Receives swept platform fees |
| Owner key | 0xaE9C9A6D49655348652D0e0A37Fa75Eb03bAC3e9 | The bounded powers below |
| Managed attester | 0xee3BDA3f836FDE2CD7B2f61C3f762cB707a4912E | Vouches for a signer that says “Orvyn signed this” |
What the owner key can and cannot do
| The owner key can | The owner key cannot |
|---|---|
| Change the treasury address | Move any vault’s balance |
| Change the fee for providers who register later, up to 20% | Change an existing provider’s fee |
| Pause new provider and feed registrations | Edit or delete a provider or a feed |
| Name the attester for managed and aggregate signers | Add a signer to anyone’s feed |
| Revoke a managed or aggregate signer, for good | Touch a provider’s own signing key |
Where the money is
- Every payment goes straight from the buyer to the provider’s own vault. Orvyn’s relayers pay the gas and never hold the money.
- USDG leaves a vault only to the provider’s payout address and, for the platform fee, to the treasury.
- A new payout address waits 48 hours before it can apply, so a stolen provider key cannot redirect the next withdrawal unnoticed.
- A payment is confirmed by the authorization’s state and the transfer event, never by a transaction’s status alone.
How it was tested
- 95 Foundry tests with 100% line, statement, branch and function coverage of the four contracts, including fuzz tests at 2,000 runs each and fork tests against the real USDG contract on Robinhood Chain.
- Six invariants: among them, a vault always holds what it owes, money leaves only to payout addresses and the treasury, a provider’s fee is locked and capped, and a feed’s identity never changes.
- End-to-end runs of the whole path: payment, settlement, a refused replay, packs, on-chain verification, withdrawal, a forged notary refused, an unmodified x402 client, an agent stopped at its budget, and twenty buyers paying in the same instant.
- An adversarial review of the contracts and the gateway found twelve problems. All twelve are fixed, each with a test that proves the fix. It was done by the people who wrote the code, which is weaker than a review by strangers.
The token’s liquidity
When $ORVYN launches, its pool position is held by Orvyn’s treasury and is not locked. Whoever holds a pool position can withdraw its liquidity, and at launch that is every token not yet bought. The address that holds it is published before launch. See the whitepaper for the rest of the token’s terms.
Reporting a vulnerability
Send a direct message to @orvyndotme on X with what you found and how to reproduce it. Please give us the chance to fix it before you publish it.