Ctrlk
x-twitterdiscord
For the complete documentation index, see llms.txt. This page is also available as Markdown.

System Integrity Overview

At a Glance

  • Audit: OtterSec (August 2026)

  • Multisig: Distributed signer set, threshold enforced

  • Timelock: 6 hours

  • Custody: Segregated accounts (ONyc SA)

  • Attestations: Apex Group (Monthly)

Control Principles

Failures in integrated protocols, contract execution, or individual keys are structurally contained and do not provide direct access to underlying collateral, reflecting a system designed to reduce common DeFi failure modes through three core constraints:

1

No single point of control

Critical actions require coordinated multisig approval. No single key or operator can unilaterally change parameters, upgrade contracts, or move funds.

2

Separation of execution and capital

Smart contracts enforce logic but do not custody underlying collateral. Capital is held in segregated accounts, preventing contract level exploits from accessing reserves.

3

Programmatic issuance and pricing

Minting and redemption are enforced by contract logic using predefined parameters. No external signer or offchain system can override pricing or supply constraints.

Protection by Design

Capital backing ONyc is held in legally segregated accounts and committed to collateralize reinsurance obligations. Collateral is not held in smart contracts and cannot be accessed through contract exploits. The collateral pool includes stablecoins, cash equivalents, and T-Bill exposure for liquidity and capital efficiency.

Sources

The mint authority is a Program Derived Address (PDA), meaning issuance can only occur through program logic. No operator or private key can mint outside defined rules.

Sources:

ONyc collateral is structurally separate from DeFi integrations. Activity in external protocols does not directly impact the underlying capital base.

Sources:

System Mechanics

ONyc is a yield bearing token on Solana representing a proportional share of a regulated, segregated reinsurance account. The system separates onchain execution (minting, redemption, NAV), offchain underwriting and capital deployment, and custody of collateral in segregated insurance accounts.

Sources:

Minting and redemption are enforced by contract logic using NAV based pricing derived from a base price, annual rate, and time component. No offchain service or external key determines issuance. A maximum supply cap is enforced at the contract level on every mint.

Sources:

NAV used for minting and redemption is computed from parameters stored within the contract. External providers such as Chainlink and Pyth support integrations and pricing inputs but do not control execution.

Sources:

Controls

Administrative actions, including parameter updates, vault management, and contract changes, require multisig approval through a distributed signer set. Ownership transfers follow a two step proposal and acceptance process.

  • A publicly viewable 3-of-6 multisig governs OnRe’s segregated liquidity reserve, supporting redemptions and broader market stability.

  • A separate publicly viewable 4-of-7 multisig governs protocol administration, including program upgrades, offer creation and management, vault administration, mint authority management, max supply configuration, fee updates, redemption controls, admin and approver management, SPL freeze authority, metadata update authority, and reactivation following a kill switch event.

Critical actions require multisig approval across multiple signers. Timelocks and execution delays are being implemented to introduce a review window before changes take effect. Designated admin accounts retain the ability to activate a kill switch to pause specific operations in the event of abnormal activity.

OnRe does not currently use durable nonces and follows standard Solana transaction execution flows, while evaluating additional sequencing and nonce based protections.

Operations and Oversight

Security operations include monitoring of onchain activity, governance actions, and execution flows. In the event of abnormal behavior, response mechanisms include multisig intervention and the ability to halt certain operations such as a kill switch.

Sources:

Smart contracts are publicly accessible. NAV, reserves, and portfolio composition are reported through transparency dashboards, supported by monthly attestations and independent audits.

The most recent independent audit was completed by Quantstamp in January 2026. Ongoing transparency is supported through additional audits and attestations.

Sources:

Current improvements include:

  • Timelock implementation

  • Evaluation of advanced nonce and sequencing mechanisms

  • Continued optimization of signer distribution

External partners including Allez Labs, Accountable, and Apex Group support data integrity, verification, and attestation processes.

Sources:

Risk and Disclosures

The primary risk is underwriting risk. If claims exceed premium income, NAV may decline, including in extreme or correlated loss scenarios.

Sources:

Summary

ONyc is structured so that minting and redemption are enforced by contract logic, token supply cannot be expanded outside program rules, collateral is held outside of smart contracts in segregated accounts, and administrative actions require multisig approval. This design reduces common DeFi failure modes and concentrates risk in the underlying reinsurance exposure.

PreviousClaims and Risk Management
NextIndependent Risk Analysis

Last updated