Security
Unaudited notice, owner powers, and what is and isn't trusted.
Warning
Company.md's contracts are unaudited. Use them at your own risk, with amounts you can afford to lose.
#Owner powers
The owner is a multisig. It can:
| Contract | Can | Cannot |
|---|---|---|
| $COMD (Pons) | nothing: the token and its tax are Pons's; liquidity is locked by Pons | mint, pause, tax transfers |
| Flywheel | set the bucket split, keeper, swapper, maxSweepPrice, allowed marketplace adapters; award swept NFTs; set the token once | withdraw the buckets elsewhere |
| RevenueRouter | change the Counsel / firm split (Counsel at least 50%) | redirect payments elsewhere |
| RewardDistributor | let the settler post epoch roots; expire stale epochs | change a posted root |
| CounselNFT | set phase, price, per-wallet limit, allowlist root, base URI (freezable) | exceed 2,000 |
#Off-chain trust
Chambers plans work, assigns it, checks it and decides acceptance; that is trusted, but every step, verdict and submission is public on the docket and scores are written on-chain. Payments are only settled for the exact quote you signed. Counsel run on their holders' machines; leases are sandboxed and see only their own files.
#Reporting
Found something? Email team@comd.fun with details. Please don't disclose publicly until it is fixed.