9 · Security

Independent audit

All Vision Makers platform smart contracts have been independently audited by CertiK and Hacken. Two independent reviews rather than one: they use different tooling and different reviewers, so a class of issue missed by one has a second chance of being caught.

Contracts are written in Solidity and deployed on EVM-compatible networks; the AI Hub marketplace settles in TON.

Audit reports and their remediation status are published separately and are the authoritative source on contract security. This document describes architecture and intent and is not a substitute for reading them.

Custody: there isn't any

Vision Makers is non-custodial at every point where custody is avoidable.

• Users connect wallets they already control: MetaMask, Trust Wallet, OKX, Binance Wallet or WalletConnect.
• Swaps execute from the user's own wallet.
• The Neobank spends an on-chain balance the user holds, not a platform float.
• Keys held by Vision Makers: none.

This constrains the product, a non-custodial system cannot reverse a user's mistake, and that constraint is precisely why interpretation matters. Where errors are irreversible, the effective defence is helping people avoid them.

Transaction safety

Control	Behaviour
Explicit signature	Every swap and agent action waits for the user to sign
Plain-language restatement	What leaves the wallet and what is expected back, stated before signing
Scoped approvals	Token approvals scoped to the amount required, not unlimited by default
Pre-staged, not executed	Agents assemble transactions; they sit awaiting signature and can be cancelled
Pre-trade risk flags	Concentration, liquidity and contract flags surface before confirmation
Rule limits	Users set caps on every automated action, size, market cap, frequency

Auditable activity record

Every swap, agent run and alert rule is logged against the user's own account. A user can always see what ran, what it found and what they signed for. This is a security control as much as a convenience: an unexplained balance change is the first symptom of compromise, and a complete local record is what makes it detectable.

Corporate standing

Incorporated entity. The operator is Vision Makers Technologies Inc., a registered corporation in the Republic of Panama. Related entities include Vision Makers Global Foundation and Vision Makers VMKS Token Inc.

Officially approved distribution. The AI Hub is an approved Telegram Apps Center application, which carries its own review process.

Operational security

Role-based access control governs internal privilege, from free tier through to institutional environments. Pipelines carry lineage end to end, which makes both compliance auditing and incident reconstruction tractable.

Vision VPN exists because network-level privacy is part of the threat model: transacting on a public ledger from an unprotected connection links a pseudonymous on-chain identity to a real network identity.

Reporting a vulnerability

Security researchers should follow the Responsible Disclosure Policy, which sets out scope, safe-harbour commitments and response targets.

Residual risk

Audits reduce risk; they do not eliminate it. The CertiK and Hacken reviews cover the contracts submitted to them at the version submitted. New deployments, upgrades, third-party integrations, front-end compromise, oracle manipulation and user-side phishing all remain live risks. These are stated in full in section 13.