This page enumerates every protection ARU provides, in plain language. Reading this gives you a complete picture of what you're trusting and what's enforced on-chain regardless of trust.
Independently audited. The production contracts (
ARU,ARUPriceOracle,ARUSubscriptionManager) were reviewed by Nethermind Security — report NM-0902, June 2026 — which reported zero findings at any severity. Read the full report (PDF) or the Audit History.
When you submit a subscription or redemption, you specify priceBound — the worst price you'll accept. The multisig cannot settle outside your bound. The contract reverts on any attempt.
This is your explicit consent, captured immutably on-chain. "The AP agreed to settle at any price within their stated range" is iron-clad legally and cryptographically.
If the multisig doesn't approve within 48 hours (admin-settable within [24h, 7d]):
cancelExpiredSubscription(id) or cancelExpiredRedemption(id)This removes the dependency on admin goodwill for refunds. Even if the multisig is compromised or incapacitated, a third-party keeper can unstick funds.
You can cancel your own request at any point before approval via cancelSubscription(id) / cancelRedemption(id). No waiting, no admin cooperation needed. Funds return immediately.
The multisig has zero ability to prevent you from cancelling. If they're mid-approval when you cancel, their approval tx reverts.
When you submit a subscription, your USDC goes to the Subscription Manager contract — not the treasury. The contract holds it until approval, or until cancel.
This means: even if the treasury is drained, emptied, or compromised, your pending subscription USDC is still refundable. The contract has custody of that USDC and can return it to you directly.
When you submit a redemption, your ARU transfers to the manager contract. It's held there. It's only burned atomically with a successful USDC payout.
If the treasury can't pay (bank-run stress, frozen assets), the approval reverts and your ARU stays safe in the contract. After 48h, you can reclaim it. Worst case is delay, never loss.
The ARU token uses a mapping of minters (isMinter[address]), not a single slot. Adding or removing a minter requires:
proposeAddMinter / proposeRemoveMinterThe 48h window is public and observable. If the owner multisig is compromised and attempts to add a malicious minter, token holders have 48h to observe and react (withdraw liquidity from DEXs, etc.) before the change takes effect. The owner can also cancelMinterChange during the window.
The ARU price oracle (ARUPriceOracle) rejects updates that change the price by more than maxPriceChangeBps (currently 3%) per update, and requires minimum interval between updates (currently 1h). Under normal conditions this provides flash-price-manipulation protection.
Note: this oracle is not on-chain-gating ARU mints/redeems — it's for downstream integrators. Admin-set settlement prices in the manager contracts are independent from this oracle for availability reasons.
ARU supports EIP-2612 permit signatures. You can approve redemption + submit a redemption request in a single transaction without a separate approve tx. Gasless approval when combined with a relayer.
MANAGER_ADMIN role is held by a Gnosis Safe with 4 human signers + 1 AutoSigner service. Routine approvals require:
No single party (including AutoSigner) can act alone. AutoSigner can always be bypassed by 3 humans for emergencies.
See Auto-Signer for the full spec.
AutoSigner doesn't trust a single oracle. It reads NAV from:
Median of three, with inter-source divergence check (sources must agree within 500 bps). Any single compromised source fails the check — AutoSigner refuses to co-sign, falls back to pure human quorum.
The treasury that holds USDC and gold is a separate Gnosis Safe with its own signers. Manager contracts pull USDC from treasury via safeTransferFrom with pre-granted allowance. Treasury can revoke the allowance at any time — a circuit breaker for extreme scenarios.
The ARU.owner role (controls minter add/remove) is held by a different Safe than MANAGER_ADMIN, with different signers, different hardware. Even if the operational multisig is fully compromised, the cold multisig can rotate the minter role with a 48h timelock.
All contracts are immutable. There is no upgrade mechanism. What deploys is what runs forever. No admin can sneak in a new implementation.
If a critical bug is discovered, the response is: freeze + redeploy + coordinate migration. Not: upgrade in place with no warning.
ARU transfers freely between any addresses. No transfer hooks. No blocklist. No pause on transfers.
This means secondary market participants never face the "your tokens are frozen" scenario. Primary market access (minting new or redeeming existing) is AP-gated; holding and trading is not.
ARU balance doesn't change unless you transfer or burn. No inflation or deflation happens to your wallet automatically. Integration with Uniswap v2/v3, Aave, etc., works without special handling.
cancelExpiredSubscription and cancelExpiredRedemption are intentionally callable by anyone. This supports an off-chain keeper economy where bots earn gas reimbursement (or nothing, as the pattern develops) for triggering refunds on behalf of distressed APs.
If you set priceBound loose (e.g., subscription at NAV + 200 bps), the multisig can settle anywhere up to that. Set tight bounds.
If the multisig delays approval until 47h59m, you can't do much except wait for expiry (1 minute later) and reclaim. They could in principle let a request expire and force you to resubmit. But this is observable misbehavior, not value extraction — admin gains nothing from it.
If you're using ARU as a price feed via latestRoundData, make sure you check updatedAt against a staleness threshold, OR use latestRoundDataStrict() which reverts on stale. The ARU contract itself doesn't consume the oracle for mint/redeem, so oracle failure doesn't affect primary market availability.
If the physical gold custodian fails, ARU's backing is at risk. This is not an on-chain risk but a counterparty risk. Reviewed in the reserves management policy (off-chain document, published quarterly).
If regulators freeze the treasury Safe, redemption approvals will fail (no USDC to transfer). Your ARU remains safe in the manager contract during pending requests. Secondary market is unaffected. This is an operational/legal risk, not a contract risk.
You trust the multisig to approve within your stated bounds within 48h; if they don't, you (or anyone) reclaim your funds; if the treasury is insolvent, your pending positions remain safe and reclaimable.
Nothing you submit can be lost to contract logic, admin misbehavior short of outright collusion with treasury fraud, or operational stalling. The 48h expiry + permissionless reclaim is the ultimate safety valve.