ORBSecurity
Money rules enforced by the database, not by hope.
Orbit moves value between people, agents and providers. These are the controls that exist today — and the ones that don't yet.
Ledger
Invariants enforced in Postgres.
Append-only ledger
Database triggers reject any UPDATE or DELETE on ledger transactions and entries. Corrections are new, balancing transactions — history is never rewritten.
Balanced transactions
A deferred constraint trigger checks at commit that every transaction has at least two entries summing to zero. Account balances can only change through ledger entries.
Non-negative balances
A database check prevents any user or agent account from going below zero, even under concurrent requests.
Integer money
All amounts are integers in nano-USD (10⁻⁹ USD). No floating-point arithmetic touches balances.
Idempotency keys
Every money movement carries a unique idempotency key, so retries and replays cannot double-charge or double-credit.
Row locking
Spend checks lock the agent row so concurrent requests serialise and cannot jointly exceed a cap.
Access
Keys, sessions and wallets.
Hashed API keys
Keys are stored only as HMAC-SHA256 hashes keyed with a server-side pepper. The secret is shown once and can't be recovered.
Scoped keys
Keys carry explicit scopes, optional spend caps, model allowlists and expiry. A key cannot mint a broader key.
SIWS replay protection
Sign-In with Solana uses single-use, expiring nonces, so a captured signature cannot be replayed.
Owner-only policy edits
Only human owners can change an agent's limits or allowlists. Agents cannot raise their own limits.
Audit log
Policy changes, pauses, key creation and revocation, and loop-breaker actions are written to an audit log.
No prompt retention by default
Prompt and response content is not stored unless the operator explicitly enables it.
Outbound
SSRF protections.
HTTPS only
Tool endpoints and fetched pages must use https; no embedded credentials, restricted ports.
Public IPs only
Loopback, private, link-local (incl. 169.254.169.254), CGNAT, ULA, multicast and reserved ranges are blocked.
Rebinding-safe
Addresses are validated inside the socket lookup; redirects are re-validated hop by hop (max 3), and size and time are capped.
Agents
Controls on autonomous spend.
Caps & limits
Daily, monthly, per-request and per-payment limits checked before any reservation.
Hierarchy containment
Children can never exceed their parent's limits or allowlists; pause cascades down the tree.
Loop breaker
Pauses or throttles agents that send too many, too-repetitive or too-failing requests per minute.
Smart contract
OrbitDeposit — the facts.
- Built on OpenZeppelin AccessControl, Pausable and ReentrancyGuard, with SafeSPL transfers.
- Exact-balance-delta check: each deposit must raise the contract's token balance by exactly the amount, rejecting fee-on-transfer and similar tokens.
- Rejects zero account ids, zero amounts, unsupported tokens, out-of-bounds amounts and plain SOL.
- 67 Foundry tests, including fuzz tests and handler-based invariants (vault balance = deposits − withdrawals; nonce = deposit count; never holds SOL), plus tests of the deploy scripts' mainnet guard.
- The backend credits only finalized
Depositedevents from the configured contract, once per (chain id, tx hash, log index). Unknown account ids go to manual review.
NOT audited
Custodial by design
Disclosure
Found a vulnerability?
Please report it privately to the operator of the Orbit instance you use, with steps to reproduce. Do not test against funds or accounts you do not own. A formal disclosure programme and contact address will be published here before any mainnet deployment.