Auditors

Auditing is one of the key functionalities on our roadmap. At MVP, there is no third party audit program. The first custodian is the developer, and assets in the first vaults are selected and sourced with trusted third parties of Konvi (asset suppliers and buyer or seller agents).

Post MVP, independent auditors will review custodians, asset intake, custody, insurance, sales processes, and on chain distribution events. Timelines are defined in the roadmap.

What auditors will do

• Custodian review. Evaluate eligibility rules, storage practices, insurance coverage, incident response procedures, and conflicts of interest.

• Asset intake attestation. For each admitted asset, verify provenance, documentation, inspection media, and custody records against the published eligibility. Produce an attestation that links to the asset claim token ID.

• Ongoing custody and insurance attestation. If applicable, checks of storage sites, access controls, inspection cadence, and insurance status. Digital proof with confirmation from the third party can be sufficient, although physical audits may carry more weight.

• Exit and yield attestation. For sales or yield events, reconcile off chain settlement to on chain EVEC distributions. Confirm that burns of asset claims and distribution math match the policies.

• Incident attestation. When material events occur, publish a short attestation with facts, impact, actions taken, and status.

How auditors plug into the protocol

• Allowlist and roles. The $XVAULT DAO recognizes two tiers of auditors: approved (DAO allowlisted) and unapproved (independent). Approved attestations carry significantly more weight in the app and in governance workflows. The DAO can add or remove approved auditors by vote. Vaults can opt in to require attestations for intake, custody, and exits, and may require that only approved attestations satisfy those requirements.

• On chain attestations. Each attestation is hashed and posted to an attestation registry with references to vault, assetClaimId when applicable, kind (intake, custody, exit, incident), scope, result, auditorTier (approved or unapproved), documentURI, and timestamp.

• Vault flags. A vault may set audit_required = true at creation. If set, the app surfaces audit status per admitted asset and blocks distribution triggers that are missing required attestations.

• Fees. When a vault opts in to auditors, a small entry fee at deposit is routed to the selected auditor. The fee levels are defined in tokenomics and can be adjusted by governance after MVP.

• Versioning and revocation. Auditors can supersede or revoke a prior attestation by posting a new record that references the old one and explains the change.

Independence and quality

Auditors disclose relationships with custodians or suppliers. Each engagement includes a signed independence statement, scope, and limitations. Reports follow a consistent format with clear conclusions, exceptions, and recommended actions.

Process overview

1. Onboard: Auditor registers (approved or unapproved) and accepts the auditor program terms set by the $XVAULT DAO, including independence and disclosure requirements.

2. Fieldwork: Auditors focus on reviewing vault characteristics, auditing changes to mutable fields, and auditing newly added assets. Tasks may include inspecting storage, reconciling inventories, testing samples of intakes and exits, and map off chain records to on chain events.

3. Report: Publish attestations to IPFS, post their hashes to the registry, and provide a short memo for users that the app can display.

4. Follow up: Track remediation items and post an updated attestation when resolved.

What custodians should prepare

Refer to the Custodians documentation for the definitive list of vault characteristics and policies that must be published and kept current (eligibility, custody and insurance, sales policy, pause and incident response, distribution rules, and versioning).

Auditors review these characteristics on an ongoing basis. When a vault’s mutable fields are updated (for example eligibility thresholds, custody or insurance policy revisions, sales policy changes) or when new assets are added to the vault, auditors may audit those changes and publish updated attestations to the registry.

What users will see

• An audit status panel on each vault page that summarizes the latest attestations, their scopes, and any exceptions. Each action can have multiple audits.

• A visible auditor tier badge (Approved or Independent) with a link to the DAO decision history.

• Per asset intake status where applicable, linked to the asset claim token ID.

• Attestation memos and hashes in the history timeline alongside deposits, distributions, parameter updates, and pauses.

Diagram, auditor flow

[Governance allowlists auditor]
          ↓
      [Vault opts in] → [Define scope]
          ↓                    ↓
   [Fieldwork and tests]  →  [Attestations]
          ↓                    ↓
 [Post memo + hash on chain]  →  [Users view status]

FAQ

Who pays for audits. The vault that opts in pays, via an entry fee on deposits and, if configured, periodic fees. For each action, the fee percentage dedicated to auditing is spread across all auditors. Details are in tokenomics.

Can anyone audit a vault. Yes. Any independent auditor can publish an attestation. The app clearly marks approved (DAO allowlisted) versus unapproved (independent) attestations. Approved attestations carry significantly more weight and satisfy vaults that require approved audits. The DAO can change the approved list through a vote.

Will audits block trading. No. Trading remains available. Audits may block specific actions in opted in vaults, for example distributions without required attestations.

What about privacy. Sensitive documents are stored off chain and linked by hash. Public memos summarize facts without exposing confidential data.