ARXAI INDEPENDENT SMART-CONTRACT AUDIT — REQUEST FOR SCOPE
Prepared: 15 September 2026
Network: BNB Smart Chain mainnet (chain ID 56)
Status: Audit provider and engagement pending

PURPOSE
This document is a request-for-scope package. It is not an audit report and does not state that an independent audit has been completed.

IN-SCOPE DEPLOYED CONTRACTS
ARXAI token
0xeaa12b3be7cdec7749b972ed5c342f4e933ccbb3

Presale round 1
0x52c880e4d54a5dd3ca7dd185d44715017b25dee0

Presale round 2
0x0709b5f668280f54b48b953c3d2bd7e137e43398

Team vesting
0x2d607fdb0da6407c29c2d4bdafab2e1479eb5ee2

Exchange release reserve
0x6af332c903c8f3fde0e620b360247c28476a2180

Liquidity reserve
0xc141a3f0c90f3fa3b5f55fac6683715a14835e42

DEPENDENCIES AND BUILD
- Solidity compiler: 0.8.36
- EVM target: Paris
- OpenZeppelin Contracts: 5.6.1
- Test framework: Hardhat 3.15
- Payment token: BSC-USDT at 0x55d398326f99059fF775485246999027B3197955

REQUIRED REVIEW AREAS
1. Fixed-supply and burn invariants.
2. Presale price, decimal conversion, minimum/maximum purchase enforcement and inventory accounting.
3. USDT transfer behavior, immediate ARXAI delivery, reentrancy and non-standard ERC-20 return handling.
4. Sale start/end boundaries, pause controls, finalization and unsold-token destruction.
5. Owner privileges, ownership transfer, treasury concentration and compromised-key scenarios.
6. Team vesting cliff, twenty calendar-date tranches and cumulative release accounting.
7. Exchange reserve: twenty fixed 28.75M ARXAI releases and recipient validation.
8. Liquidity reserve release authorization, recipient safety and future LP-token-lock integration.
9. Denial-of-service, rounding, front-running, griefing and unexpected-token recovery scenarios.
10. Deployment bytecode/source correspondence for every listed mainnet address.

KNOWN OPEN RISKS TO VALIDATE
- Administrator and treasury are currently the same externally owned account.
- Independent audit has not yet been completed.
- Existing internal branch coverage is 47.12%; additional negative-path testing is requested.
- The liquidity-reserve vault holds ARXAI; an LP-token locker can only be deployed after a real pool creates LP tokens.
- Website-side USDC/BNB conversions use third-party routing and must be assessed separately from the presale contracts.

EXPECTED DELIVERABLES
- Manual and automated source review.
- Severity-ranked findings with reproducible evidence.
- Privilege and trust-assumption matrix.
- Mainnet deployment/configuration validation.
- Remediation review and final public report identifying the exact reviewed source revision.
- Explicit statement of exclusions and residual risk.

CURRENT PUBLIC EVIDENCE
- BscScan and Sourcify links are published on the ArexAI Security page.
- Internal security review and automated test report are public.
- The project will continue to label the audit as pending until a signed final report is delivered by an independent provider.