Orbit Exchange
LiveConcentrated-liquidity AMM with on-chain limit orders.
Rewards by severity
When you submit, the report is permanently bound to this version (fingerprint dbfcf3f628…e39c). Scope, impacts, rewards, SLAs and policies can't be changed for your report later, even if Orbit Exchange publishes a new version.
Assets in scope
2 assets
| ID | Asset | Type | Target |
|---|---|---|---|
| ORB-1 | PoolManager | Smart contractBase | 0x0ab10000…00000001 |
| ORB-2 | LimitOrderHook | Smart contractBase | 0x0ab10000…00000002 |
Track record
Computed from case events. Projects can't edit these numbers.
Policies
The first report that identifies a root cause is eligible. Later reports sharing the same root cause are duplicates, even when they describe a different attack path, unless they demonstrate a materially higher impact.
Issues listed in published audits or recorded as known-issue commitments before the submission timestamp are ineligible. Commitments may be revealed during a dispute.
Public disclosure requires approval from both parties after the fix is deployed and verified. Default embargo: 30 days after fix.
Either decision may be escalated to an independent platform mediator within 7 days of the project's final decision. The mediator publishes a reasoned decision to both parties.
Rewards are paid in USDC within the payout SLA after retest passes or after a Won't Fix decision. A Won't Fix decision never cancels an earned reward. The amount equals the locked reward calculation.