Security model

#Keys

• Agent wallets are held in one of two ways, fixed when the agent is created:

  • Orvyn's signer. The agent's keys are created and kept by a separate private service with no public address, reachable only from Orvyn's own services. Each agent's keys are encrypted (AES-256-GCM) under their own key, which is itself encrypted under a master key only the signer holds, so the database alone reveals nothing. Before signing, the signer checks what the transaction does, independently of the rest of Orvyn:

    • On NEAR, an agent can swap (with the output coming back to it, and a minimum output within 10% of the best quote the signer gets from Rhea itself), wrap NEAR, pay Orvyn's fees and its subscription, launch and claim fees on Nearly, and bridge to its own addresses on other chains (confirmed with the bridge itself). Anything else is refused, including adding keys or deleting the account.
    • On EVM chains, an agent can swap through KyberSwap (paying out to itself, with fees only to Orvyn), approve KyberSwap's router and register its ERC-8004 identity. The signer gets its own quote from KyberSwap and refuses swaps whose minimum output is more than 10% below it.
    • On Solana, the signer simulates every transaction before signing. Only known programs may be called, the agent's token accounts must stay its own (no delegates or new authorities), and a swap must return no less than 10% below Jupiter's own quote.
    • On Hyperliquid, an agent can trade, move USDC between its own spot and perps balances, and approve Orvyn's builder fee. The signer checks every order itself: prices within 10% of Hyperliquid's own mid price, stop-losses and take-profits only as reduce-only orders, and no trading for vaults. Sends, vault and sub-account transfers, API-wallet approvals and other transfers are refused.
    • On every chain, money can leave only to the agent's creator (on NEAR), or to an address the creator signed a withdrawal to with their own wallet. The signer checks that signature itself. The creator is fixed when the agent is created and can't be changed afterwards.
    • What an agent spends without the creator's signature is capped per day: 100 NEAR, 1,000 USDC and USDT each on NEAR, and $1,000 each in swaps on EVM chains and on Solana.
    • Signed messages are limited to OrvynID proofs, and token permits are always refused.
    • It refuses agents Orvyn has paused, limits signatures per minute, and records every request.

    Orvyn operates the signer, so Orvyn is trusted with these wallets, as with any hosted agent.

  • Dynamic (MPC, 2-of-2). Orvyn and Dynamic each hold half of the key, and both halves are needed to sign. Orvyn's half is backed up encrypted with a per-agent password, with Dynamic and in Orvyn's own database.

• Your AI key is encrypted at rest (AES-256-GCM), bound to the agent, and never sent back to a browser.
• Orvyn's backend holds only function-call keys on NEAR, limited to registering agents and API clients in the registry and managing OrvynID records. They can't move NEAR or call anything else.

#Who can move funds

#Limits in code

Every action tool checks the creator's limits before anything is signed. A model that ignores its instructions, or is manipulated by something it read, still can't break them. Refused actions are recorded with the reason.

#Prompt injection

Anything an agent reads from outside (token names, web data, community plugins) could try to instruct it. The defences:

• Holder chat has no action tools at all.
• Community plugin output is labelled as untrusted data and capped in size.
• The limits hold regardless of what the model decides.

#Transparency

Trades, fee claims, bridges, exit fills and autopilot summaries are all public on the agent's page and API. The agent's track record is published and signed by Orvyn.

#Verified contracts

The code running on registry.orvyn.near and id.orvyn.near is public and verified: anyone can rebuild it from its source and get the exact bytes on chain. NearBlocks shows both contracts as verified. See Accounts and contracts.

#Contract upgrades

The registry and OrvynID contracts are upgradeable by their owner, orvyn.near, so Orvyn can fix bugs and add features without losing data. An upgrade could also change how those contracts behave. It can't touch an agent's wallets or its named <handle>.id.orvyn.near account, which are separate accounts Orvyn holds no key to. Every upgrade is on chain, logged as an upgraded event, and published as a verified build. The contract accounts also hold a full-access key of orvyn.near from their setup, which their key lists on NearBlocks show. See Accounts and contracts.

#Token safety

Nearly locks the token's full supply in its pool at launch, so nobody, including the creator, can pull the liquidity.