01What this page covers
This page describes the security of VORA Chain 3318, the explorer at vorascan.io and the validator staking contract. It is written to be checkable: where something has been verified, we say how, and where it has not, we say so.
There are two published EVM Smart Audit reports and they cover different things. One covers the VORA token on BNB Chain, which belongs to the presale. The other covers this staking contract on chain 3318 and is the one summarised in section 04. Neither report says anything about the other contract, so do not read one as covering both.
02How your funds are held
The staking contract is non-custodial. There is no deposit address controlled by a person, no admin key that can move a validator deposit, and no upgrade proxy that can swap the logic underneath you.
Money inside the contract is kept in three buckets that never mix:
| Bucket | What it holds | Who can move it |
|---|---|---|
| Principal | Validator deposits, 1,000,000 VORA per seat | Only the seat holder, only after the lock expires |
| Treasury | Funds set aside to pay APY | The owner, but never below interest already earned |
| Pending rewards | Shares calculated but not yet claimed | Only the validator they belong to |
The consequence is the part that matters: the owner cannot take back what stakers are already owed, and cannot touch principal at all.
03Safeguards written into the contract
- The lock cannot be extended. Your unlock time is fixed at the moment you stake. No later transaction by anyone can push it further out.
- Two-step ownership transfer. Handing over ownership requires the new owner to actively accept it. A mistyped address cannot orphan the contract, and a pending transfer can be cancelled.
- Treasury floor. A withdrawal that would leave less than the accrued interest owed to validators is rejected by the contract, not by policy.
- Fixed economics. Seat size and seat count are compile-time constants. They cannot be altered after deployment by any party.
- State before transfers. Balances are updated before VORA is sent out, the standard ordering that closes reentrancy.
- Published source. The contract source is verified on the explorer, so the code you read is provably the code that runs.
04What the audit found
The contract that is live on chain 3318 has been reviewed by EVM Smart Audit. The report is public at that link and covers this exact deployment, compiled with the same compiler that produced the verified source.
Risk score
11 findings by severity
OWASP Smart Contract Top 10
10 / 10 clear- ✓ Access control
SC01 - ✓ Price oracle manipulation
SC02 - ✓ Logic errors
SC03 - ✓ Input validation
SC04 - ✓ Reentrancy
SC05 - ✓ Unchecked external calls
SC06 - ✓ Flash loan attacks
SC07 - ✓ Overflow and underflow
SC08 - ✓ Insecure randomness
SC09 - ✓ Denial of service
SC10
SWC Registry
11 / 12 clear- ✓ Reentrancy
107 - ✓ Privileged functions
105 - ✓ Unprotected selfdestruct
106 - ✓ tx.origin authorisation
115 - ✓ Overflow and underflow
101 - ✓ Unchecked return value
104 - ✓ Delegatecall to untrusted
112 - ✓ Weak randomness
120 - ! Block values as time proxy
116 - ✓ DoS by gas or unbounded ops
128 - ✓ Floating pragma
103 - ✓ Variable shadowing
119
The two non-gas findings are worth stating precisely rather than waving away.
- The timestamp finding is inherent to the product. It points at the constructor line that records when the first distribution period begins. A staking contract that locks deposits for a year and accrues interest by the second has to read the clock; there is no version of it that does not. A block producer can nudge the timestamp within a small window, which is immaterial against a one-year lock and a one-day distribution cycle.
- The two event findings are false positives. The analyser flags withdraw() and withdrawTo() for emitting nothing. Both are thin wrappers around one private function, and that function emits Withdrawn. Static analysis does not follow the call. Every withdrawal on chain carries the event.
Alongside the external report the contract carries its own regression suite: 58 cases run against the settings it is deployed with, including a full one-year lock and real one-day distribution cycles. It reached this state through eleven rounds of review, and the tests from every round are kept so that a later change cannot quietly reopen an earlier hole.
Static and AI-assisted analysis narrows the search; it does not replace a line-by-line manual audit, and the report says so itself. Read it as one strong signal among several, not as a guarantee.
05Infrastructure
The explorer, the staking page and the RPC endpoint run on hardened infrastructure. The current configuration:
| Area | Measure |
|---|---|
| Transport | TLS 1.2 and 1.3 only; TLS 1.0 and 1.1 refused; HTTP redirects to HTTPS; HSTS enforced |
| Exposure | Only SSH, HTTP and HTTPS reachable from the internet. Databases, caches and node RPC bind to loopback only |
| Firewall | Default-deny inbound, with brute-force banning on the login service |
| Public RPC | Administrative, account, mining, debug and transaction-pool methods are disabled. No key is held on the RPC node. Rate limited per IP |
| Administration | Two-factor: password plus a one-time code sent by email. Passwords stored with bcrypt. Sessions are HttpOnly, Secure and SameSite strict |
| Keys | Validator and operational keys are readable only by root, including inside backups |
| Backups | Chain state, databases and keys backed up daily without downtime |
06Keeping your own wallet safe
- Check the address bar. The only staking page is vorascan.io/staking/. Bookmark it and use the bookmark.
- Read what you sign. A stake is a plain transfer to the contract. If a prompt asks for an unlimited token approval or a signature you did not initiate, reject it.
- Never share a seed phrase. No support person, admin or team member will ever ask for it. Nobody needs it to help you.
- Use a hardware wallet for a seat-sized amount. One million VORA deserves it.
- Be suspicious of urgency. Pressure to act immediately is the most reliable sign of a scam.
07Impersonation and scams
These are the only domains we operate. Anything else claiming to be VORA staking is not us.
- vorascan.io - explorer, staking, RPC
- vorachain.com - project site and token presale
We will never send you a direct message asking you to connect a wallet to unlock, verify, migrate or rescue funds. There is no support agent who needs your keys. There is no emergency that requires you to move your seat.
08Reporting a vulnerability
If you find a security issue in the contract, the explorer or the infrastructure, report it privately and give us a reasonable window to fix it before disclosing publicly.
Write to security@vorachain.com. Include enough detail to reproduce the issue - the affected component, the steps, and the impact you believe it has. Please do not run tests that degrade the network for other users, and do not access or modify data that is not yours.