> For the complete documentation index, see [llms.txt](https://whitepaper.zodor.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://whitepaper.zodor.io/security-and-privacy/security-measures.md).

# Security Measures

### **Security Measures in the Protocol:**

* **Regulated KYC and Token Transfer Restrictions:**
  * Ensuring platform integrity by implementing stringent KYC procedures.
  * Limiting token transfers to regulated channels to mitigate risks.
* **Smart Contract Security Testing and Auditing:**
  * Paramount importance placed on identifying and eliminating vulnerabilities in smart contracts.
  * Rigorous testing and auditing procedures to maintain platform safety.
* **Decentralized Identity Management:**
  * Leveraging ERC-725 for secure authentication and authorization.
  * Facilitating decentralized identity management to enhance security.
* **Privacy Enhancement through Homomorphic Encryption:**
  * Utilizing Partial Homomorphic Encryption (PHE) to encrypt security token balances.
  * Protecting user privacy by ensuring confidentiality during computations.

### **Objective of Security Implementation:**

*

```
The protocol implements comprehensive security through several key mechanisms:
```

```
#### Core Security Implementations <a href="#core-security-implementations" id="core-security-implementations"></a>

**KYC and Transfer Controls**  Stringent KYC procedures at signup; `ZodorComplianceModule` blocks every non-compliant transfer at the contract level.

**Smart Contract Safety**  270+ Solidity tests across unit, fuzz, and invariant suites. Foundry fuzz runs 10,000 iterations per property; invariant tests run depth 50. Slither + Mythril gate every PR.

**Identity Management**  ERC-734/735 (ONCHAINID) for decentralized identity; ZK-KYC with Groth16 proofs for privacy-preserving verification.

**Privacy Protection**  Three-mode privacy stack (ZK-KYC, Paillier, Zama fhEVM) plus the Path C model for futures-style instruments.

**Backend Security**  JWT with RS256 signing; rate limiting (500 req / 15 min on `/graphql`); helmet + CORS allowlist; Sumsub HMAC-SHA256 for webhook authentication; AWS Lambda execution role with least privilege.

**Bridge Security**  CCIP `MessageId` receipts validated on both sides; LayerZero OFT trust assumptions documented; compliance precheck on both source and destination chains.

**Operational Security**  `.env` is gitignored; `.env.example` for templates; deployer keys stored only in CI secrets; deployed addresses canonicalized in `scripts/deployed-addresses.json`.

#### Audit & Continuous Hardening <a href="#audit--continuous-hardening" id="audit--continuous-hardening"></a>

* Foundry fuzz + invariant CI
* Slither static analysis on every PR (zero HIGH / CRITICAL gate)
* Mythril deep symbolic analysis on token + bridge contracts
* External production audit scheduled before mainnet launch
* Bug bounty program planned post-audit
* Continuous monitoring through Sentry (frontend) and CloudWatch (backend)
* Community feedback channels in the Zodor Discord and Telegram
```