Security & governance
The treasury and the system’s admin rights are controlled by multisig wallets, so that no individual can move funds or change the system on their own.
| Measure | What it means for you | Status |
|---|---|---|
| 2-of-3 multisig | No individual can move the funds alone. | In development |
| Emergency pause | If an attack is detected, token transfers can be paused to protect assets. | In development |
| OpenZeppelin library | Contracts are built on security code widely used across the industry. | In development |
| Internal security review | The engineering team reviews the code for common vulnerabilities. | In development |
| Manipulation-resistant pricing | Transactions are rejected when ETH price data is stale or abnormal. | Up next |
| Independent audit | An external security firm reviews the full codebase. | Not active |
| Verified source code | Anyone can read and verify the contracts on BaseScan. | Up next |
What is a multisig wallet?
Picture a safe with three keys that only opens when at least two key holders agree. The treasury and the film production fund are held in wallets like this, controlled by the Board of Directors of Rivermind Pictures. Every withdrawal must be approved.
How does the emergency pause work?
If unusual activity or an attack is detected, token transfers can be paused to stop the damage from spreading. Once the system is on mainnet, this power belongs to the multisig wallet, not to any individual.
Who governs the system?
During testing, the engineering team holds admin rights in order to test and fix issues. On mainnet, all admin rights are transferred to the Board of Directors’ multisig wallet. Every upgrade or release of funds also requires the signature of the technology lead.
What the internal review checks
Before deployment, the contracts are scanned with automated analysis tools for the most common classes of smart contract vulnerability:
- Reentrancy: a contract being called back before it has finished updating balances, which can be used to drain funds.
- Integer overflow: a number exceeding its limit and wrapping around to a wrong value.
- Denial of service: a transaction or state that blocks the contract from working for everyone else.
- Front-running: someone seeing a pending transaction and jumping ahead of it to gain an unfair price.
The review must report no critical or high-severity issues before the contracts move to mainnet.
Price feed safeguards
- Stale prices are rejected: if the Chainlink ETH/USD price is more than an hour old, the payment is refused.
- Invalid prices are rejected: a zero or negative price can never be used.
- Precision is tested: ETH and $RVM use 18 decimal places while USDC uses 6. Boundary tests make sure conversions between them are exact.
Audit
The team is carrying out an internal security review and preparing documentation for an independent audit. Audit results will be published on this page once complete. No external auditor has reviewed the system yet.