> For the complete documentation index, see [llms.txt](https://onex-3.gitbook.io/onex-document/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://onex-3.gitbook.io/onex-document/swap/security-28-layers.md).

# Security 28 layers

> Security is not a feature. It is the foundation on which every other feature rests. ONEx deploys 28 independent, mutually reinforcing security layers — more than any other DeFi protocol in existence.

Each layer was designed based on the specific attack vectors that have caused the **$12.5+ billion in DeFi losses** between 2020 and 2024.

***

## All 28 Security Layers

| #  | Layer Name                                       | Primary Protection                                                      |
| -- | ------------------------------------------------ | ----------------------------------------------------------------------- |
| 1  | Formal Mathematical Specification (TLA+)         | Protocol logic correctness before any code is written                   |
| 2  | Formal Smart Contract Verification (Certora)     | Mathematical proof of contract correctness                              |
| 3  | Multi-Firm Audit Strategy (6 firms)              | Code vulnerability discovery by independent experts                     |
| 4  | Invariant Fuzzing CI/CD                          | Automated invariant checking on every code change                       |
| 5  | Immutable Core Architecture (3-Tier)             | Upgrade and admin key attacks on user funds                             |
| 6  | Multi-Pattern Reentrancy Prevention              | Reentrancy exploit vectors across all entry points                      |
| 7  | Zero-Trust Access Control                        | Unauthorized privilege escalation                                       |
| 8  | Flash Loan Attack Prevention (TWAP Mandatory)    | Price manipulation via same-block flash loans                           |
| 9  | Nine-Source Oracle Security Pyramid              | Oracle price manipulation — requires 5-of-9 with decentralized majority |
| 10 | Price Sanity Checker                             | Stale, corrupted, or outlier price data                                 |
| 11 | Cross-Chain Security Gateway (2-of-3 Quorum)     | Bridge attacks and relay manipulation                                   |
| 12 | Governance Attack Prevention                     | Flash-loan governance raids and vote manipulation                       |
| 13 | AI System Security                               | Adversarial input attacks and model poisoning                           |
| 14 | Real-Time AI Threat Detection                    | Live exploit detection via statistical anomaly monitoring               |
| 15 | Supply Chain Security (SBOM)                     | Compromised npm/pip dependencies and build artifacts                    |
| 16 | Frontend Security (CSP + SRI)                    | Malicious script injection and phishing site clones                     |
| 17 | MPC-TSS Cryptographic Key Management             | Key theft — threshold signatures with no single point of compromise     |
| 18 | DDoS & Infrastructure Protection                 | Availability attacks on frontend and API infrastructure                 |
| 19 | Economic Attack Simulation (1,000+ scenarios)    | Novel economic attack vectors before deployment                         |
| 20 | Anti-Sandwich Commitment Scheme                  | Front-running even by protocol-level actors                             |
| 21 | Seven Automated Circuit Breakers (Safe Design)   | Cascading failure events — protects users, never traps funds            |
| 22 | Decentralized Watchtower Network                 | Invariant violations monitored by incentivized independent nodes        |
| 23 | Human Security Architecture (Multi-Jurisdiction) | Insider threats and social engineering                                  |
| 24 | $20M Bug Bounty Program                          | Unknown vulnerabilities — up to $5M per critical finding                |
| 25 | Four-Layer Insurance Architecture                | Post-incident user fund recovery — up to $200M total                    |
| 26 | 60-Minute Incident Response Playbook             | Coordinated rapid response to active exploits                           |
| 27 | Zero-Knowledge Proof Security                    | Privacy and validity proofs — PLONK or STARK proof system               |
| 28 | Quantum-Resistance Preparation                   | Signature scheme abstraction for future post-quantum upgrade            |

***

## Layer 5: Immutable Core Architecture

| Tier                   | Contracts                                                                                  | Upgradeability                                                                                     |
| ---------------------- | ------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------- |
| **Tier 1 — IMMUTABLE** | Asset Vault Contracts (all user funds), Settlement Finality Contract, Emergency Withdrawal | Never upgradeable. Critical rule: Tier 1 contracts NEVER hold references to upgradeable addresses. |
| **Tier 2 — GOVERNED**  | Routing Logic, Fee Calculation, Oracle Integration, Liquidity Management Logic             | 72-hour timelock. Any change requires 72-hour notice before activation.                            |
| **Tier 3 — FAST**      | UI/UX Helper Contracts, Analytics and Reporting, Non-financial feature contracts           | 24-hour timelock.                                                                                  |

***

## Layer 9: Oracle Security Pyramid

**5-Level Defense:**

| Level                              | Mechanism                                                                           |
| ---------------------------------- | ----------------------------------------------------------------------------------- |
| Level 1 — Multi-Source Aggregation | Primary: Chainlink, Pyth, RedStone, Chronicle. Backup: Band, DIA, Tellor, API3, UMA |
| Level 2 — TWAP Validation          | Spot price cannot deviate more than 5% from the 2-block TWAP                        |
| Level 3 — Cross-Source Consensus   | 5 sources must agree within 1%. At least 3 must be from decentralized oracle group. |
| Level 4 — Circuit Breaker          | Price moves >10%/hour or >20%/day trigger a pause                                   |
| Level 5 — AI Anomaly Detection     | Flags 3-sigma outliers. Triggers human review.                                      |

***

## Layer 11: Cross-Chain Security Gateway — 2-of-3 Quorum

> **Critical design decision:** The original "all 3 bridges must agree" design was replaced. Requiring unanimous agreement created a **liveness vulnerability** — if any single bridge experiences downtime (Wormhole had a 24-hour outage in 2022), ALL cross-chain operations would halt.

| Transaction Size    | Bridge Consensus Required                               |
| ------------------- | ------------------------------------------------------- |
| Under $10,000       | Instant after proof verification from 2-of-3 bridges    |
| $10,000–$100,000    | 2-of-3 bridge consensus + 15-minute delay               |
| $100,000–$1,000,000 | All 3 bridges must agree + 1-hour delay                 |
| Over $1,000,000     | All 3 bridges + 24-hour delay + governance notification |

***

## Layer 21: Seven Automated Circuit Breakers — Safe Design

> **The absolute rule:** WITHDRAWALS ARE NEVER PAUSED. Circuit breakers slow or pause new deposits and large outflows, but individual user withdrawal requests must always be processable.

| Trigger  | Condition                           | Correct Action                                                                                    |
| -------- | ----------------------------------- | ------------------------------------------------------------------------------------------------- |
| Price    | >15% move in one block              | Suspend pair trading 5 minutes. Withdrawals unaffected.                                           |
| TVL      | >10% drop in 5 minutes              | Pause NEW deposits. Rate-limit large outflows above $500K. Individual withdrawals ALWAYS proceed. |
| Volume   | 10x normal in 1 minute              | Rate limit new trades to 100 TPS. Existing positions and withdrawals unaffected.                  |
| Oracle   | Sources disagree >2%                | Pause price-sensitive operations. Withdrawals at last valid price remain available.               |
| Gas      | 10x spike above 1-hour average      | Delay large non-urgent transactions. Emergency withdrawals always processed.                      |
| Contract | New unverified contract interaction | Flag and notify security team. Pause interaction with that specific contract only.                |
| Bridge   | Unusual message pattern             | Pause affected chain pair only. Other chains and all withdrawals continue normally.               |

***

## Layer 25: Four-Layer Insurance Architecture

| Layer                                      | Coverage                                 | Details                                                                                                   |
| ------------------------------------------ | ---------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| Layer 1 — Protocol Insurance Vault         | Smart contract exploits, oracle failures | Funded by 15% of protocol fees. Target: maintain 10% of total TVL. Payout within 72 hours.                |
| Layer 2 — Decentralized Insurance Partners | Up to $95M combined                      | Nexus Mutual: $50M. InsurAce Protocol: $25M. Sherlock Protocol: $20M.                                     |
| Layer 3 — Traditional Insurance            | Cyber liability for custodial assets     | Subject to policy exclusions (available on request). Supplemental to on-chain coverage.                   |
| Layer 4 — Protocol-Owned Safety Reserve    | Treasury backstop                        | 20% treasury in stablecoins. Governance vote required for access. Auto-replenished from protocol revenue. |

**TOTAL MAXIMUM COVERAGE: Up to $200,000,000 across all four layers combined.**