Halborn audit

Halborn's 2024 assessment of the LUMIA token's staking, governance, and conversion contracts, and exactly what it did and did not cover.

Who this is for: issuers, developers, and operators who need to know exactly what Halborn did and did not review before citing this engagement as evidence of anything.

Scope, stated plainly, first: this audit covered a specific set of governance, staking, and token-conversion smart contracts, not the Lumia chain's protocol layer. Halborn did not review the sequencer, the zkProvers, the data-availability layer, or the bridge. See Audits.

This page does not restate finding counts or describe individual findings.

Engagement

Field	Value
Auditor	Halborn
Report title	"Lumia - Orion" Smart Contract Security Assessment
Engaged by	Orion. Per the report, the Orion team held the client relationship for this contract set.
Date of engagement	March 28, 2024 to May 6, 2024
Report last updated	July 22, 2024
Repository assessed	lumia
Assessed commit ID	1eced82
Public report link	Not published. The report is client-held rather than published to Halborn's public reports repository.

What was in scope

Per the report's Scope section, the assessed files were:

contracts/governance/base/StakingReward.sol
contracts/governance/base/Staking.sol
contracts/governance/base/StakingRewardProxy.sol
contracts/governance/base/TWBalance.sol
contracts/governance/OrionProxy.sol
contracts/governance/veORN.sol
contracts/governance/OrionFarmV2.sol
contracts/governance/interfaces/ITWBalance.sol
contracts/governance/interfaces/IStaking.sol
contracts/governance/interfaces/IERC20Minimal.sol
contracts/governance/interfaces/IStakingReward.sol
contracts/governance/interfaces/IOrionVoting.sol
contracts/governance/interfaces/IConverter.sol
contracts/governance/interfaces/IveORN.sol
contracts/governance/interfaces/IOrionFarmV2.sol
contracts/governance/OrionVoting.sol
contracts/governance/libraries/TransferHelper.sol
contracts/governance/libraries/Math.sol
contracts/Converter.sol
contracts/Lumia.sol

plus a named diff range (orionprotocol/cfd/compare/53180bfb...fabd02a1). Explicitly out of scope: third-party dependencies, economic attacks, and any new features or implementations added after the remediation commit IDs.

The report's own introduction frames what this contract set does: "The Lumia smart contracts add staking and governance features to the ORN token ecosystem. ORN can also be burned and converted to LUMIA 1:1." That is a token and governance layer, not the chain's execution or consensus layer, which is why this report cannot stand in for a chain-protocol audit.

This is the contract set that converted the former ORN token to LUMIA. The engagement predates the rebrand, which is why the report title, the client name, and several assessed filenames carry the Orion name.

Scope of what this page establishes

The engagement is real and its scope is exactly the contract set listed above. What it does not establish is anything broader: not that Lumia's contracts in general are secure, not that the chain passed an audit, and not any outcome for the chain's protocol layer. Halborn did not review the sequencer, the zkProvers, the data-availability layer, or the bridge, so this report is silent on them (see Audits).