Restricted
No unrestricted DeFi use
Clearing tokens are not designed for unrestricted swaps, farming, leverage, lending pools or arbitrary smart-contract integrations.
01 · Security Principle
Reduce the attack surface before trying to defend it
ORUSD and OEURO are clearing instruments, not open DeFi assets. Their technical perimeter is intentionally narrow in order to reduce external dependencies, unauthorized integrations and attack paths.
Controlled
Manager-gated mint / burn
Issuance and destruction remain controlled operations. This permits a defined administrative response to erroneous, fraudulent or disputed positions.
Auditable
Explicit state transitions
Security-sensitive actions must remain attributable, logged and reviewable, with a clear distinction between normal clearing, dispute containment and final resolution.
Design rule.
The clearing token is intentionally less composable than a conventional DeFi asset.
Reduced composability is treated as a security property.
02 · Temporal Security Layer
The clearing cycle creates a security window
High-speed automated attacks benefit from immediate finality. Osnias Clearing uses the opposite logic: clearing positions circulate within a defined cycle before final settlement. This creates time to identify anomalies, receive a contestation and isolate a disputed amount.
Detect
Anomaly appears
Monitoring, participants or the manager may identify an operation that appears unauthorized, abnormal or inconsistent with the expected clearing activity.
Contain
Disputed value can be isolated
During the clearing cycle, the disputed amount may be removed from normal circulation and placed into an internal escrow state.
Resolve
Settlement waits for resolution
The affected value remains immobilized until the parties agree on an outcome or an applicable external decision determines the result.
Temporal security.
Speed is an advantage for an attacker only when speed also produces irreversible economic finality.
The clearing cycle deliberately separates those two events.
03 · AI-Assisted Cyberattack Resilience
Designed against high-speed automated exploitation
AI-assisted attackers may automate reconnaissance, vulnerability discovery, transaction generation, social engineering and repeated exploitation attempts. Osnias therefore treats machine-speed attacks as a design assumption rather than an exceptional event.
Attack surface
Fewer external execution paths
By excluding unrestricted swaps, lending, farming, leverage and arbitrary contract use, the clearing rail avoids many attack paths created by open protocol composability.
Containment
No requirement for instant economic finality
A suspicious transaction does not necessarily become an irreversible loss immediately. Within the protocol rules, the disputed amount can be isolated while facts are reviewed.
Administrative security
Fast containment, slow structural change
Emergency actions should be narrowly scoped. Critical governance, upgrade and treasury powers should remain separated from operational incident response.
Mainnet objective
Cold and multisignature controls
Production architecture is intended to separate online operational systems from dormant multisignature and cold-storage controls used for critical recovery or structural actions.
Important.
Temporal containment is not a substitute for secure code, audits, key management or incident-response procedures.
It is an additional defensive layer that limits the ability of a fast attack to become an immediate irreversible loss.
04 · Internal Dispute Escrow
A disputed amount can be isolated inside the clearing cycle
Commercial disagreements and unauthorized operations can occur even when the underlying infrastructure is functioning correctly. Osnias therefore distinguishes a disputed amount from the remainder of a participant's position.
Request
One party raises a dispute
A participant may request the conservative isolation of a clearly identified amount linked to a specific operation.
Escrow
Only the disputed amount is immobilized
The manager may place the contested amount into protocol escrow. The purpose is preservation, not adjudication or confiscation.
Neutrality
Osnias does not decide the dispute
Osnias does not determine which party is legally right. It provides a technical mechanism that preserves the disputed value while the parties resolve the matter.
Core rule.
The manager may immobilize disputed value but does not acquire beneficial ownership of it
and does not exercise a judicial or arbitral function.
05 · Human Error & Address Misrouting
A clearing cycle can also contain ordinary human mistakes
Not every abnormal transaction is fraudulent. A wrong click, an incorrectly copied address or selection of the wrong participant can create a genuine misrouting error. Osnias Clearing therefore treats human error as a distinct operational-security case.
Identifiable participant
The destination address must be attributable
An address alone does not identify its controller. Within the clearing perimeter, participating addresses should therefore be registered or otherwise attributable to an identified participant so that the relevant party can be contacted.
Acknowledgement
The recipient confirms the erroneous receipt
A simple addressing mistake is not corrected unilaterally by Osnias. The participant controlling the destination address must acknowledge that the amount was received in error, or the parties must otherwise establish a mutually agreed correction.
Correction
Controlled burn / mint return
Once the error is acknowledged, the manager may execute the agreed correction by burning the identified amount from the erroneous destination address and minting the same amount back to the originating or otherwise agreed correct address.
Human-error rule.
A wrong click does not automatically justify administrative reversal.
Correction requires an identifiable destination participant and documented recognition
of the error, mutual agreement, or another applicable external basis.
06 · Controlled Escrow Relocation
Burn and mint can implement a traceable escrow relocation
Where the clearing-token implementation permits manager-controlled burn and mint on identified addresses, an escrow relocation can be performed by burning the disputed amount from the contested address and minting the same amount to the designated escrow account.
| Step | Action | Economic effect |
|---|---|---|
| 1 | Identify the disputed operation and exact amount | No change |
| 2 | Burn the disputed amount from the contested address | Temporary reduction before corresponding escrow mint |
| 3 | Mint the identical amount to the designated escrow account | Supply-neutral administrative relocation when executed as one controlled operation |
| 4 | Immobilize the escrow position until resolution | Disputed amount unavailable for normal clearing |
Mainnet implementation objective.
Where technically feasible, escrow relocation should be implemented atomically so that burn and corresponding mint
either complete together or fail together.
07 · Amicable Resolution
The parties decide; Osnias records and executes
Once value is safely isolated, the preferred path is a direct negotiated settlement between the parties. Osnias may invite them to reach an amicable resolution but does not impose the terms.
Negotiate
Parties remain autonomous
The parties may agree on restitution, attribution, partial allocation or another technically executable outcome.
Record
Osnias takes note of the agreement
The agreed resolution is documented and linked to the corresponding dispute record before execution.
Execute
Technical implementation
The manager executes the mutually agreed outcome through the permitted clearing-token mechanisms.
08 · External Dispute Resolution
If there is no agreement, the dispute remains external to Osnias
If the parties do not reach an amicable settlement, they remain free to refer the dispute to a competent court, arbitral body or other external mechanism available to them under applicable law or contract.
Pending
Escrow remains in place
The disputed amount remains immobilized while the external procedure is pending, subject to the protocol rules and any applicable legal requirements.
Outcome
Applicable decision is executed
Once an enforceable or otherwise applicable external decision is presented and verified, the manager executes the corresponding technical disposition of the escrowed amount.
No internal court.
Osnias Clearing provides containment and execution infrastructure.
It does not replace courts, arbitrators or other competent external dispute-resolution bodies.
09 · Resolution Paths
One escrow, several controlled outcomes
| Resolution | Authority for outcome | Protocol action |
|---|---|---|
| Full restitution | Mutual agreement or applicable external decision | Escrow amount returned to the designated address |
| Full attribution | Mutual agreement or applicable external decision | Escrow amount assigned to the designated recipient |
| Split allocation | Mutual agreement or applicable external decision | Escrow amount redistributed according to the documented allocation |
| Final destruction | Only where explicitly authorized by the applicable resolution and protocol rules | Burn without corresponding remint |
10 · Operational Separation
No single online component should control the entire system
Operations
Day-to-day clearing
Routine clearing operations should use narrowly scoped permissions and avoid exposure of structural control keys.
Emergency
Containment powers
Emergency functions should prioritize freezing or limiting risk rather than transferring value or modifying governance.
Recovery
Dormant critical controls
Multisignature, cold-storage, cryptographic backups and an external production registry are intended to protect critical recovery and deployment authority.
Administrative domain separation.
Compromise of an OSNIAS privileged role must not, by design, grant manager, oracle, mint, burn
or fee-recipient authority over ORUSD or OEURO.
11 · Security Validation Pipeline
Static analysis is one layer, not the audit itself
Security review is intended to combine reproducible compilation, static analysis, unit tests, fuzzing, invariant testing, integration testing and manual review. Slither supports pre-audit analysis, but does not replace an independent security audit or production monitoring.
Static analysis
Slither
Map privilege surfaces, externally callable state-changing functions, supply paths, dangerous external calls and unexpected routing surfaces.
Behavioral testing
Unit · Fuzz · Invariants
Test oracle authorization, proof replay, request expiry, mint/burn accounting, fee conservation, EOA-only restrictions and holder-property constraints.
Integration
Sei Testnet
Exercise the verified public reference deployments, wallet behavior, oracle lifecycle, governance locality and cross-contract separation before any production deployment.
Pre-mainnet objective.
An external audit remains a required institutional milestone before production qualification.
Current public contracts are testnet reference deployments.
12 · Security Scope
Security by layered containment
13 · Important Notice
Security architecture, not a guarantee.
No blockchain system can guarantee the absence of cyberattack, operational error or dispute.
The mechanisms described on this page are intended to reduce attack surface, improve containment,
preserve disputed value and provide a controlled path to resolution before or during clearing settlement.
Security controls remain subject to implementation, testing, independent audit and production qualification.