Skip to main content

Audits & Testing

Test suite​

The contract suite ships with 71 automated tests covering every function and revert path:

  • Deployment & configuration (owner, default token, allowlist)
  • Sends: balances, events, memos, per-token totals, self-send/gateway-address/zero-address/zero-amount/allowance reverts
  • Multi-send: per-recipient amounts, the 100-recipient batch limit and its boundary, length mismatches, atomicity
  • Requests: fixed & open amounts, exact-amount enforcement, expiry, double-fulfillment, cancellation rights
  • Subscriptions: interval floor, immediate first charge, due-time gating, pull & push, third-party rejection, cancellation by either party, halt on token delisting
  • Refunds: recipient-only, full-amount, double-refund prevention, unknown-payment rejection
  • Admin: allowlist management (default token cannot be disabled), pause/unpause behavior, token rescue, two-step ownership
  • Aruvi Names: registration rules, name validation, availability, release and re-registration, owner-only moderation
  • Link registry: per-merchant save and remove events, empty-data rejection, merchant isolation

Internal review (July 2026)​

Before the Arc Testnet deployment, the contract went through an internal audit pass checked against Arc's EVM differences. Findings fixed prior to deploy:

  1. Stuck funds - payments and subscriptions addressed to the gateway contract itself are now rejected (InvalidRecipient).
  2. Mixed-currency totals - sentTotal/receivedTotal are tracked per token, so EURC amounts are never summed into USDC figures.
  3. Bricked default path - the owner can no longer remove allowlist support for the current default token.
  4. Zombie subscriptions - recurring charges stop if their settlement token is delisted.
  5. Recovery - an owner-only rescueTokens recovers tokens mistakenly transferred straight to the contract (which never custodies funds in normal operation).

Run them yourself:

cd contracts && npm install && npx hardhat test

Building blocks​

Aruvi's security-critical code paths run through OpenZeppelin Contracts v5 (SafeERC20, ReentrancyGuard, Ownable2Step, Pausable) - among the most audited Solidity code in existence. The Aruvi-specific logic on top is intentionally thin.

External audit status​

No external audit yet

The Arc version of Aruvi has not undergone a third-party security audit. It runs on testnet only. An external audit of the full contract suite - gateway, Aruvi Names, and link registry - is scheduled before any mainnet deployment, and the report will be published here. See the Mainnet Roadmap for the full pre-launch checklist. Until then, treat the contracts as experimental software.

Responsible disclosure​

Found a vulnerability? Please open a private security advisory on GitHub rather than a public issue.