Build
Security
Planned security measures for UNDO, including two audits before launch, caps, non-upgradable contracts, a limited pause and a bug bounty.
Audits
Two independent audits are planned before launch. Neither has taken place. No audit firm has been announced.
| Audit | Timing | Scope |
|---|---|---|
| First audit | Phase 2 of the roadmap, with the testnet contracts | The six contracts as deployed on testnet |
| Second audit | Phase 4 of the roadmap | The final code, including open arbitration and appeal |
Reports will be published in full when they exist. If this site ever shows an audit, it will link to the report.
An audit lowers risk. It does not remove it. See Risks.
Caps
Limits are designed to keep any single failure small.
- Per-payment cap. A single protected payment can be at most 2,500 USDC.
- Capped mainnet launch. Mainnet will open with caps, and with the Agent lane first. Agent lane amounts are small and most refunds there are decided by a signature check, not by a vote.
- Leverage tiers. A new seller starts at 1x, where every instant payout is fully backed by the bond.
- Auto-freeze. A seller above 5% lost disputes over 30 rolling days is frozen to 1x.
Non-upgradable contracts
The contracts are designed to be non-upgradable. There is no proxy and no admin key that can replace the code holding bonds and escrowed payments.
This has a cost. A bug cannot be patched in place. A fix means deploying new contracts and letting users move, with the old contracts still honouring refunds and withdrawals. We think that is the right trade for a protocol whose job is to hold other people's bonds.
Governance is bounded in the same spirit. It covers parameters only, never funds.
Pause
The design includes a pause. Its scope is narrow.
| Action | During a pause |
|---|---|
| New protected payments | Can be stopped |
| New agent sessions | Can be stopped |
| Refunds to buyers | Never blocked |
| Automatic claims on open sessions | Never blocked |
| Open disputes | Continue to their outcome |
| Withdrawal of released payouts and free bonds | Never blocked |
A pause can stop new payments. It never blocks refunds or withdrawals. Nobody should be able to trap funds by pausing, including us.
Bug bounty
A bug bounty is planned. Its scope, rules and rewards are not defined yet and will be published before mainnet.
Until then, if you find a problem in the site or the simulation, contact us through the X account at x.com/UndoOnArc. Please do not post exploitable details in public.
The simulation
The simulator on this site is safe to try.
- It moves no real funds.
- It never sends a transaction.
- It never asks for a signature or an approval.
- The wallet connection is read-only: it is used for identity and to read a USDC balance.
If a page claiming to be UNDO asks you to sign or approve something today, it is not ours.