Risk disclaimer

Depositing into a smart contract exposes you to total, permanent, unrecoverable loss of your funds. There is no deposit insurance, no chargeback, no support desk that can reverse a transaction, and no legal recourse against a contract. Do not deposit money you cannot afford to lose entirely.

Our internal review found 24 issues, including a critical defect in the USDC yield vault which valued shares against a yield-adapter balance it never funded — a depositor could have burned their entire share position and received nothing while their principal remained stranded in the contract. Two further high-severity findings affected the signed rebalance path and the reputation registry.

All 24 are fixed and covered by regression tests. That is not the same as the code being free of defects: it means the defects we were capable of finding are closed. Software that has had 24 issues found in it has, historically, had more. Every finding is published here.

The contracts have been reviewed internally by the people who wrote them. That is useful and it is not an audit. No external security firm has examined this code. An internal review reliably finds the bugs its authors are capable of imagining.

Nothing on this website is investment, financial, legal or tax advice, an offer to sell, a solicitation to buy, or a recommendation regarding any asset. Nobody involved in Zorpha is acting as your adviser, broker or fiduciary. Historical receipts describe what happened and imply nothing whatsoever about what will happen.

$ZOR does not entitle you to dividends, interest, profit share, revenue share, or any claim on the assets of the protocol, the treasury or any entity. The buyback mechanism reduces token supply; it is not a distribution to holders and it is not a commitment about price. No statement on this site should be read as forecasting a price, a market capitalisation, a return, or a listing.

• Smart contract risk. Code may contain defects, including ones nobody has found yet. Some are already known and published.
• Oracle risk. Price feeds can be stale, wrong, manipulated, or unavailable. Vaults fail closed where possible, which converts a pricing failure into an availability failure rather than a loss — but not in every case.
• Manager risk. Managers can be wrong, repeatedly, in ways that are entirely visible and still lose you money. Verifiability is not skill.
• Key compromise. A stolen manager key can push vault exposure to a harmful target within the vault’s limits until it is rotated.
• Underlying asset risk. Tokenised equities can fall in value, be halted, be delisted, or diverge in price from the asset they reference.
• Liquidity risk. There may be no market in which to sell $ZOR or a vault share at any particular price, or at all.
• Governance risk. Privileged roles exist. They are behind a 48-hour timelock and a multisig, which delays and publicises their use rather than preventing it.
• Regulatory risk. The treatment of tokens and tokenised securities varies by jurisdiction and can change, including retroactively.
• Testnet status. Everything is currently deployed to testnet. Testnet assets have no value, and testnet state can be reset or discarded without notice.

Zorpha is not deployed to any mainnet. Any token presented as $ZOR on a mainnet today is not ours. Always verify contract addresses against zorpha.xyz before interacting with anything.

You are responsible for determining whether you are permitted to use this software where you live, for your own tax position, and for the security of your own keys. If any part of this document is unclear, the correct response is to take professional advice, not to proceed and hope.