Security Architecture
How OrbitPad protects users, projects, and funds
Non-Custodial by Design
OrbitPad never holds user funds. All financial operations — contributions, claims, vesting — are executed through smart contracts on public blockchains. The platform indexes on-chain events for fast querying, but the chain remains the source of truth for all financial state.
Smart Contract Security
ReentrancyGuard
All sale contracts use ReentrancyGuard to prevent reentrancy attacks on contribution and claim functions.
SafeERC20
Token transfers use OpenZeppelin SafeERC20 wrappers to handle non-standard ERC-20 implementations safely.
AccessControl
Role-based access control ensures only authorized accounts can finalize sales, pause contracts, or manage whitelists.
Pausable
Emergency pause functionality allows admins to halt sales in case of detected vulnerabilities or anomalies.
Merkle Whitelists
Scalable allowlist verification using Merkle proofs — thousands of whitelisted wallets with minimal gas cost.
Checks-Effects-Interactions
All contract functions follow the checks-effects-interactions pattern to prevent common vulnerability classes.
Audit Checklist
Responsible Disclosure
If you discover a vulnerability, please report it responsibly through our official security channels. Do not exploit vulnerabilities or disclose them publicly before they are addressed.