Security

Security Architecture

How OrbitPad protects users, projects, and funds

Non-Custodial by Design

OrbitPad never holds user funds. All financial operations — contributions, claims, vesting — are executed through smart contracts on public blockchains. The platform indexes on-chain events for fast querying, but the chain remains the source of truth for all financial state.

Smart Contract Security

ReentrancyGuard

All sale contracts use ReentrancyGuard to prevent reentrancy attacks on contribution and claim functions.

SafeERC20

Token transfers use OpenZeppelin SafeERC20 wrappers to handle non-standard ERC-20 implementations safely.

AccessControl

Role-based access control ensures only authorized accounts can finalize sales, pause contracts, or manage whitelists.

Pausable

Emergency pause functionality allows admins to halt sales in case of detected vulnerabilities or anomalies.

Merkle Whitelists

Scalable allowlist verification using Merkle proofs — thousands of whitelisted wallets with minimal gas cost.

Checks-Effects-Interactions

All contract functions follow the checks-effects-interactions pattern to prevent common vulnerability classes.

Audit Checklist

Reentrancy protection on all state-changing functions
Integer overflow protection (Solidity 0.8.x built-in)
Signature replay prevention for authentication
Double-claim prevention via on-chain accounting
Correct vesting math with cliff and linear unlocks
Pro-rata oversubscription allocation with refunds
Emergency withdrawal for stuck funds
No upgradeability — immutable deployed contracts

Responsible Disclosure

If you discover a vulnerability, please report it responsibly through our official security channels. Do not exploit vulnerabilities or disclose them publicly before they are addressed.