> For the complete documentation index, see [llms.txt](https://city-protocol.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://city-protocol.gitbook.io/docs/security/security-and-risk.md). # Security and risk Audits, monitoring and the controls that address each principal risk. ## Audits and monitoring Zenith audited the Issuance & Operation Layer, Vault as a Service and Tokenization as a Service, with the report dated 25 June 2026, and all critical and high findings are resolved. The $CIT OFT token contract and the OTP Architecture contracts were also reviewed by Zenith. At product level, Delta-Neutral Prime USD has been audited by 0x Macro, Pashov and Spearbit, and the reports are published on the [Audits](/docs/security/security-and-risk/audits.md) page. Each deployment is checked before launch for role transfer, oracle quorum, deviation tolerance, fee disclosures, strategy caps and source verification. Role, oracle, NAV, settlement, pause and fee changes emit indexed events, and a master proof-of-solvency dashboard from an independent provider lets anyone verify Curated Vault TVL in real time.
Each Curated Vault and each OTP account is a separate unit, so a failure stays where it occurs

Each vault and each OTP account is its own unit, so a failure stays within the unit where it occurs.

## Principal risks Each principal risk has its own controls. Controls reduce these risks, and none of them removes risk entirely: markets can move against any strategy, so participants can lose part or all of the value they commit. | Risk | How it arises | Principal controls | | ------------------------ | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------ | | Smart contract | A defect, misconfiguration or exploit in the vault contracts, the OTP modules or a smart account | Independent audits, test coverage, atomic transactions, bounded execution, layered pauses and pre-launch checks | | Oracle and valuation | An incorrect, stale or manipulated NAV or price input | Reporter quorum, freshness and deviation checks, snapshot settlement and pauses on failed updates | | Strategy and curator | Strategy losses, mandate breaches or curator failure | Curator-bound execution, allowlists and debt caps, drawdown and leverage limits, circuit breakers and disclosure | | Counterparty and custody | Failure of a trading venue, custodian, tokenized-asset issuer or service provider | Venue exposure caps, independent attestation, proof of deployment, reserve verification and constituent validation | | Liquidity and timing | Redemption windows, epoch settlement or thin markets delay an exit | Disclosed liquidity terms, the funded-claim rule and single-transaction OTP exit | | Governance and keys | Capture of governance or compromise of an administrative key | Multisig custody of roles, timelocks, role separation and separate pause and unpause | | Regulatory | A change in law restricts products or the token | Eligibility controls at subscription, interface geofencing and product-level restrictions | ## Topics * [Audits](/docs/security/security-and-risk/audits.md): audit reports and proof-of-solvency dashboards. * [Oracle and NAV design](/docs/security/security-and-risk/oracle-and-nav-design.md): how a NAV report becomes eligible for settlement. * [Risk isolation and emergency controls](/docs/security/security-and-risk/risk-isolation-and-emergency-controls.md): per-unit isolation, liquidation and unwind logic, pauses and circuit breakers. * [Contract security](/docs/security/security-and-risk/contract-security.md): the contract surface, roles, settlement, limits and monitoring in technical detail.