Security and risk

Audits, monitoring and the controls that address each principal risk.

Audits and monitoring

Zenith audited the Issuance & Operation Layer, Vault as a Service and Tokenization as a Service, with the report dated 25 June 2026, and all critical and high findings are resolved. At product level, Delta-Neutral Prime USD has been audited by 0x Macro, Pashov and Spearbit, and the reports are published on the Audits page. Each deployment is checked before launch for role transfer, oracle quorum, deviation tolerance, fee disclosures, strategy caps and source verification. Role, oracle, NAV, settlement, pause and fee changes emit indexed events, and a master proof-of-solvency dashboard from an independent provider lets anyone verify Curated Vault TVL in real time.

Each vault and each OTP account is its own unit, so a failure stays within the unit where it occurs.

Principal risks

Each principal risk has its own controls. Controls reduce these risks, and none of them removes risk entirely: markets can move against any strategy, so participants can lose part or all of the value they commit.

Risk	How it arises	Principal controls
Smart contract	A defect, misconfiguration or exploit in the vault contracts, the OTP modules or a smart account	Independent audits, test coverage, atomic transactions, bounded execution, layered pauses and pre-launch checks
Oracle and valuation	An incorrect, stale or manipulated NAV or price input	Reporter quorum, freshness and deviation checks, snapshot settlement and pauses on failed updates
Strategy and curator	Strategy losses, mandate breaches or curator failure	Curator-bound execution, allowlists and debt caps, drawdown and leverage limits, circuit breakers and disclosure
Counterparty and custody	Failure of a trading venue, custodian, tokenized-asset issuer or service provider	Venue exposure caps, independent attestation, proof of deployment, reserve verification and constituent validation
Liquidity and timing	Redemption windows, epoch settlement or thin markets delay an exit	Disclosed liquidity terms, the funded-claim rule and single-transaction OTP exit
Governance and keys	Capture of governance or compromise of an administrative key	Multisig custody of roles, timelocks, role separation and separate pause and unpause
Regulatory	A change in law restricts products or the token	Eligibility controls at subscription, interface geofencing and product-level restrictions

Topics

• Audits: audit reports and proof-of-solvency dashboards.

• Oracle and NAV design: how a NAV report becomes eligible for settlement.

• Risk isolation and emergency controls: per-unit isolation, liquidation and unwind logic, pauses and circuit breakers.

• Contract security: the contract surface, roles, settlement, limits and monitoring in technical detail.