Documentation
Concise methodology describing how we perform Proof‑of‑Reserve, smart‑contract audits, and continuous monitoring. Minimal fluff, maximum clarity.
Proof‑of‑Reserve overview
PoR demonstrates that a custodian or exchange holds on‑chain assets at least equal to user liabilities. We use cryptographic commitments (Merkle roots) to let users verify inclusion of their anonymized balance without revealing others.
Assets: discovery & verification
We compile signed wallet lists per chain (BTC, EVM, TRON, etc.), confirm control via signed messages or on‑chain movements, and tag addresses (hot, cold, operational). Balances are captured block‑height‑pinned.
Liabilities: anonymized tree
User balances are aggregated and salted, then hashed into a Merkle tree. Each user receives a leaf proof. Double‑counting and negatives are forbidden by constraints in the tree construction and by total checksum disclosure.
Solvency ratio
ratio = onchain_assets / user_liabilities. We present chain‑by‑chain tables and consolidated view. Threshold alerts can be set for real‑time monitoring.
Smart‑contract audit method
We combine manual review (spec vs. code), threat modeling, and automated analysis (Slither, Mythril, Foundry tests) with focus on access control, arithmetic, upgradeability, and economic security.
Reporting & remediation
Findings are graded (Critical → Low) with PoC, impact, likelihood, and fix recommendations. A verification pass confirms patches. Clean reports include full diff review.
Continuous monitoring
Optional add‑on: on‑chain balance watchers, reserve ratio alerts, contract event sentries, uptime checks, and dependency CVE feeds. Incidents include a 60‑minute triage SLA.
Compliance & standards
We align with industry guidance (SOC‑like controls for custody processes), follow responsible disclosure, and support regulatory inquiries with signed attestations upon request.
Public PoR JSON sample
Minimal endpoint schema you can host at /por/latest.json or similar.
{
"snapshot_time": "2025-10-10T12:00:00Z",
"merkle_root": "0x3f5b...9a2e",
"assets": [
{"chain": "BTC", "addresses": ["bc1q..."], "balance_btc": 123.45},
{"chain": "ETH", "addresses": ["0xabc..."], "balance_usd": 51234567.89}
],
"liabilities_checksum": "0x9d7c...e101",
"solvency_ratio": 1.08,
"proof_url": "/por/proofs/{user_hash}.json"
}FAQ
How long does a PoR take?
Typical scope ships in 3–7 business days depending on chains and data access. Retainers shorten lead time.
What do users get to verify?
An inclusion proof for their anonymized balance plus public root and snapshot details.
Do you store customer data?
We minimize data. Liability inputs can be hashed client‑side; raw records are deleted post‑attestation.
Audit vs. code review?
Code review checks style and minor issues; an audit models threats, tests assumptions, and validates safety properties.
Can you publish a public PoR page?
Yes. We provide a minimal static page or JSON endpoint you can embed.
Final call to action
Boost credibility with a verifiable audit. Start with a 15‑minute scoping call.