Security

How to report a vulnerability, what has been audited, and where these docs describe the trust model of the protocol.

Report a vulnerability

Write to [e-mail]. Do not open a public issue or a public pull request for a security finding.

Include	Why
The contract, the function and the commit or version concerned	To reproduce on the same code
The steps or a test that shows the issue	A Foundry test against the repository is the fastest path
The impact you see: what can be moved, blocked or forged, and by whom	To set the priority
Whether the issue is known to anyone else	To coordinate disclosure

The scope is the code of the two repositories, T-REX-Network/T-REX and T-REX-Network/ONCHAINID. Applications built on the protocol, such as those of the AppStore, are reported to their own providers.

Audits

Component	Version	Auditor	Report
ONCHAINID	3.0.0	OpenZeppelin	ONCHAINID Audit
T-REX	5.0.0	Audit in progress	Listed in Audits and verification when it is published

The scope of each audit, the tests, the formal specifications and the mutation testing are described in Audits and verification.

Where the trust model is described

Question	Page
Who is trusted for what	Trust assumptions
What the contracts guarantee in every state	Invariants
What happens when something goes wrong	Emergency behavior
Who can call what	Access manager and roles

For teams that operate an asset

• Roles are keys. Each role of a suite is as strong as the account that holds it. The roles that grant other roles, ADMIN_ROLE, AGENT_ADMIN and SUITE_ADMIN, deserve the strictest custody.

• Watch the events that signal an incident. Paused on a token that no agent paused, ReplayedSettlement, LateReconciliation and ValidationIssuancePaused on its compliance. See 36 Handle a late reconciliation or a halt.

• Know what a shared contract can change. A shared suite follows the versions the network publishes, and a shared module follows its own upgrades. An isolated suite and a module of your own remove that dependency.

• Check addresses on-chain. The reads in Deployments tie each contract to the ones it depends on.