Security and audits
The status of the independent security audit of the RealTime contracts, who can upgrade or pause them, and where the audit report will be published.
Audit status
In progress An independent security audit is underway. Its scope and the full report will be published here before trading launches on Arc Mainnet.
Admin controls
Who can upgrade, own or pause the exchange contracts, as read from the chain itself rather than stated by us.
- 11 of the 14 exchange contracts can be upgraded: an upgrade replaces a contract's code while its address stays the same.
- Upgrades of 10 of them are authorised by a single externally owned account (one private key):
0xeb88a92d727a0bd117d96bed38e6b1709522979f. - quantumRiskEngine decides in its own code who may upgrade it.
- The same account owns 12 of the 14 contracts.
- 7 of the 14 contracts can be paused, which stops the operations the pause guards until they are unpaused. None was paused when read.
| Contract | Upgradeable | Upgrade authority | Owner | Pausable |
|---|---|---|---|---|
router | Yes (beacon proxy) | 0xeb88…979f Explorer single key (EOA) | 0xeb88…979f Explorer single key (EOA) | Yes |
orderHandler | Yes (beacon proxy) | 0xeb88…979f Explorer single key (EOA) | 0xeb88…979f Explorer single key (EOA) | Yes |
marketFactory | Yes (beacon proxy) | 0xeb88…979f Explorer single key (EOA) | 0xeb88…979f Explorer single key (EOA) | No |
unifiedVault | Yes (beacon proxy) | 0xeb88…979f Explorer single key (EOA) | 0xeb88…979f Explorer single key (EOA) | Yes |
positionHandler | Yes (beacon proxy) | 0xeb88…979f Explorer single key (EOA) | 0xeb88…979f Explorer single key (EOA) | Yes |
backstopVault | No | — | 0xeb88…979f Explorer single key (EOA) | Yes |
oracle | Yes (beacon proxy) | 0xeb88…979f Explorer single key (EOA) | 0xeb88…979f Explorer single key (EOA) | Yes |
dataStore | Yes (beacon proxy) | 0xeb88…979f Explorer single key (EOA) | 0xeb88…979f Explorer single key (EOA) | No |
marketHandler | Yes (beacon proxy) | 0xeb88…979f Explorer single key (EOA) | 0xeb88…979f Explorer single key (EOA) | No |
balanceManager | Yes (beacon proxy) | 0xeb88…979f Explorer single key (EOA) | 0xeb88…979f Explorer single key (EOA) | No |
perpRouter | Yes (beacon proxy) | 0xeb88…979f Explorer single key (EOA) | 0xeb88…979f Explorer single key (EOA) | Yes |
gaslessPerpRouter | No | — | — | No |
agentRegistry | No | — | — | No |
quantumRiskEngine | Yes (UUPS proxy) | Set in its own code | 0xeb88…979f Explorer single key (EOA) | No |
Read from Arc Testnet on 2026-10-14: the EIP-1967 proxy slots and each contract's owner() and paused(). A dash means the contract has no proxy slot or no owner(); any other access rules are in its code.
The contracts
The exchange runs on smart contracts, and your deposits are held in them. Every contract address on each network is listed on Network and contracts, so you can check the contracts you interact with on the block explorer.
Keeping your own account safe
What you sign, what the app stores in your browser and how to avoid phishing is on Security and safety.