Security
If you have security concerns, encounter issues, or need to report suspicious activity:
Read our Safety and Security Guide for best practices, learn how to Get Help, provide feedback, or check our Crypto Terminology guide if you need clarification.
For immediate support, visit our Discord server and open a support ticket.
Aims
As a Web3 company, security is our highest priority. Managing user funds through products like SkyBridge and Airfox Arcade is a privilege that comes with tremendous responsibility. Our comprehensive security framework is built on three fundamental principles:
- Multiple Layers of Protection: We implement multiple independent security measures, from multi-signature controls to multiple third-party audits.
- Proactive Risk Management: Continuous monitoring helps identify potential vulnerabilities before they can impact users.
- Transparent Operations: Every security measure and administrative action is verifiable on-chain, and advertised ahead of time, maintaining full accountability to our community.
Audits & Monitoring
Airfox's security is maintained through multiple independent audits and continuous monitoring:
- SkyBridge V1: Two independent smart contract audits by Hacken. The current SkyBridge V2 bridge has not undergone a third-party audit.
- Token Contract: Smart contract audit by SolidProof.
- Active Monitoring: Hacken Extractor provides real-time exploit detection with
pauserrole capabilities. - Smart Contract Management: OpenZeppelin Defender manages contract upgrades.
Smart Contract Security
Airfox Arcade Access Control
The Airfox Arcade admin account is protected by a 3-of-5 multi-signature contract. The admin account controls upgrades to the Airfox Arcade proxy contract. All five signers are KYC-certified by SolidProof.
SkyBridge Access Control
SkyBridge V2's admin functionality is secured through the SkyBridge Admin Safe — skybridge-admin.eth (0x1Bd922A1Dc99303CF8a683a5a5C9215045873Ddb) — a 3-of-5 multi-signature contract deployed identically on all supported chains. All five signers are KYC-certified by SolidProof.
The admin can:
- Update bridging fees and the fee collector address.
- Register or remove supported chains and bridge lanes.
- Pause bridging for users.
- Authorize contract upgrades (EntryPoint upgrades and Diamond cuts).
- Manage roles for other accounts.
Full list of signers:
SkyBridge Fee Collection
Protocol fees accumulate in the EntryPoint contracts and are swept — permissionlessly, by anyone calling collectFees() — to the SkyBridge Fee Collector Safe (0xA953B9DF3b081709eA75895cF5a8fAf7DCC29354), a 2-of-3 multi-signature contract. The full balance always goes to the Safe; no caller ever retains fees.
Full list of signers:
| Address |
|---|
| 0xfe8Ea68368B784D7ac9C8aA25c91085D67350916 |
| 0x09Aece5D1E3Ec2Be71Fd63DE8A647a8eFcB569EF |
| 0x4fe6Ecd1c7CF37F24f474C37Fc1cf20D201Db4fd |
Contract Upgradeability
Airfox Arcade and SkyBridge use proxy contracts for upgrades, allowing for bug fixes and feature improvements. Updates require multi-signature approval, protecting against unauthorized changes.
Compliance
Airfox operates under US regulations with:
- Full FinCEN and corporate registration.
- Continuous legal counsel and SEC compliance monitoring.
- Regular OFAC sanctions review.
- Global community protection standards.