Transparency
Audits & assurance
Published on-chain assurance
Settlement activity on Chain 138 is independently verifiable without DBIS attestation. Counterparties may reconcile portal-published addresses against live chain state:
- Block explorer — transactions, contracts, token holders, PMM pool activity
- /.well-known/trust.json — canonical Stack A PMM integration and pool addresses (v0.5.1)
- token-list API — machine-readable token registry
- Source and deployment artefacts — Gitea
CI validates that published trust anchors match the canonical Chain 138 contract registry before portal deploy.
Published audit summaries
Summaries below are registry transparency artefacts. Full statutory regulatory audit books remain supervisor-confidential in raw form; secret-free redacted derivatives or integrity indexes are required for public review wherever internally obtainable. Counsel review remains a raw-disclosure control, not a blocker for safe public audit extracts.
| Report | Published | Scope | Link |
|---|---|---|---|
| CyberSecur Global — Scope E Formal Security Audit Report | 2026-06-28 | Formal third-party smart contract audit — all five contract sets (CSG-SCOPE-E-2026-001) | |
| Ecosystem Audit Transparency Report | 2026-06-17 | Public summary — accounting pack opinion, smart contract workpapers, scheduled engagements | Markdown |
| OMNL Fineract books — Scope B secret-free audit derivative | 2026-11-09 | Read-only aggregate GL policy and reconciliation scan; raw books remain private | JSON |
| GUOSMM Series E — registry summary (source currently unavailable) | 2026-06-17 | Official gazette source; last probe recorded HTTP 404 in the manifest | Unavailable (HTTP 404) |
Machine-readable manifest: /audit/manifest.json
Each manifest record identifies its source, observation time, hash or explicit hash status, scope, freshness, and publication limitations. Records are not labelled owner-submitted; Safe queueing is shown separately from execution and admission.
Smart contract audit (Scope E)
CyberSecur Global delivered the formal Scope E smart contract security audit report (CSG-SCOPE-E-2026-001 PDF) covering HYBX-OMNL-CORE, VAULT-W-TOKEN, TRUSTLESS-BRIDGE, GRU-CORE-V1, and GRU-TRANSPORT-V1. Machine-readable opinions live under config/compliance/smart-contract-audit-opinion-*.v1.json in the proxmox registry.
- Intake / engagement — cybersecur.d-bis.org
- Tooling org — CyberSecur-Global-AG
Scheduled accounting assurance
| Scope | Engagement | Firm | Start | Status |
|---|---|---|---|---|
| B | Annual IPSAS / IFRS financial statement audit | Roy Walker Law PLLC | 2026-07-01 | External audit pending; internal derivative published |
| D | Reserve sufficiency attestation (indexer / DefiLlama methodology) | Roy Walker Law PLLC | 2026-07-15 | Scheduled |
| E | Formal third-party smart contract security audit | CyberSecur Global | 2026-06-17 | Delivered — formal report published |
External assurance (financial)
Pack-scope external opinion on the 3FR $900B opening balance compliance pack was signed 2026-05-31 (Roy Walker Law PLLC). The internally generated Scope B derivative is published above; the full annual financial statement audit remains pending and will be listed here when completed.
Internal audit & risk
High-level themes from the internal audit plan (IT general controls, treasury operations, third-party risk) will be summarised quarterly. Detailed workpapers remain confidential.
Smart contract registry
The 131 deployed smart contracts on Chain 138 (including cUSDT, cUSDC, cXAUC, cXAUT, DODOPMMIntegration, and CompliantWrappedToken contracts) undergo security review. Contract addresses are published in trust.json and the Infrastructure page.