Justin justinbarry

XION / Verona Security and Audit Summary

Prepared: June 10, 2026

This note consolidates the technical/security wording, public audit links, upstream security references, and audit-coverage context for the XION/Verona chain.

Executive summary

XION / Verona is built on a security-first architecture that combines:

Now I have all the data verified. Here is the complete security audit report:

Security Audit Report: Redacted Platform

Date: 2026-03-03
Scope: oauth3/ (Rust/Axum TEE authorization server) + Redacted/ (Next.js + CosmWasm frontend)
Auditor: Claude Code (Automated Static Analysis)

Private Key Example

Is the candidate comfortable working remotely?
What is the expected graduation date of the candidate?
Is the candidate open to 4-month or 8-month internship?
If the candidate is from University of Waterloo, ask for the date that they plan to submit employer rating. (note: this is because we need to extend an offer before that date if it’s a match)
Confirm the candidate’s location is US or Canada + the candidate can legally work in these two locations

Requirement Collection:

Functionality:

	import {MsgSendEncodeObject, SigningStargateClient, StdFee} from "@cosmjs/stargate";
	import {DirectSecp256k1Wallet, OfflineDirectSigner} from "@cosmjs/proto-signing";
	import {fromHex} from "@cosmjs/encoding";


	(async function () {
	const recipients = [
	'xion1adgdmkfrpgu749d5qahwxmu3jzcp77mm5wxddq',
	'xion19jerqdcz7u2220q2xj078hndcqv8z8kjj3trsp',
	'xion1te8gp204fserypat7h8mere5pz39afsn6ssn67',

	import { makeADR36AminoSignDoc, serializeSignDoc } from "@keplr-wallet/cosmos";
	import { Hash, PrivKeySecp256k1 } from "@keplr-wallet/crypto";

	function signArbFn(address: string, privateKey: string) {
	const cryptoPrivKey = new PrivKeySecp256k1(fromHex(privateKey));

	return async (message: string \| Uint8Array): Promise<string> => {
	const signDoc = makeADR36AminoSignDoc(address, message);
	const serializedSignDoc = serializeSignDoc(signDoc);
	const digest = Hash.sha256(serializedSignDoc);

	const {send: transportGRPC} = require("@onflow/transport-grpc")
	const fcl = require("@onflow/fcl")
	const {TransactionAuthorizer} = require("@freshmint/core")
	const {
	HashAlgorithm,
	InMemoryECSigner,
	SignatureAlgorithm,
	InMemoryECPrivateKey,
	} = require("@freshmint/core/crypto")

	import FungibleToken from 0xf233dcee88fe0abe
	import FiatToken from 0xb19436aae4d94622

	transaction {
	prepare(signer: AuthAccount) {
	// Return early if the account already stores a FiatToken Vault
	if signer.borrow<&FiatToken.Vault>(from: FiatToken.VaultStoragePath) != nil {
	return
	}
	// Create a new ExampleToken Vault and put it in storage

	# folders
	node_modules/
	dist/
	.parcel-cache/
	flowdb/

	.exrc
	.DS_Store

	# file types