Score: 5/5

(a) Problem the project solves

• Umbra is a financial privacy layer for the Solana Blockchain. It provides the cryptographic infrastructure necessary to execute confidential transactions, allowing users and applications to protect their financial data on-chain.

(b) Operational priorities

• We completed our fundraise on Metadao and will be using our capital from the raise plus future revenues post mainnet for ongoing work on the Umbra Private Wallet and future products

(c) High-level project overview

• We provide the infrastructure for confidential, unlinkable, and auditable transactions, making on-chain privacy seamless and secure.
• We use Arcium’s MPC Infrastructure under the hood for our mixer pool technology to enable confidential as well as anonymous transfers

(d) Primary token functions

UMBRA is an ownership coin. The token is the sole economic and governance instrument; there is no separate equity class. Its primary functions are:

• Governance participation: Token holders participate in protocol decision-making through MetaDAO's decision market mechanism. Rather than stake-weighted voting, participants trade on proposal outcomes using the governance token or USDC. Proposals pass or fail based on time-weighted average price (TWAP) resolution of conditional PASS and FAIL markets.
• Treasury control: Governance controls the DAO treasury. Proposals may authorize spending USDC from the treasury, issuing new tokens, updating token metadata, and adjusting treasury-provided liquidity.
• IP ownership: Key protocol intellectual property is assigned to the DAO entity and governed by decision markets. No individual or external party holds independent IP rights. Value accrues to UMBRA through governance authority over treasury capital and any protocol revenues. There is no automatic or standing distribution to holders; any distribution, buyback, or capital return requires a governance proposal to pass.

(e) Control surface reliance

• This is currently work in progress but we will explore the potential of using decision markets for core protocol upgrades, decryption keys, etc.
• We will also introduce a failsafe privacy committee that will be prominent.

Score: 3/3

Based on the provided Operating Agreement for Phoenix DAO LLC, there is no formal Foundation, Lab team, or traditional human leadership structure that exists. Instead, we have a decentralized, "algorithmically managed" structure where decision-making is shifted away from humans to a technical mechanism. PhoenixDAOLLC_Operating_Agreement.pdf Apart from this, we have another entity for KYC purposes - UmbraPrivacy Ltd. based in BVI. KYC is the sole purpose for this entity. Anything of value (IP, Revenue) flows only and only through PhoenixDAO LLC.

Score: 5/5

(a) IP ownership & control

UMBRA IP and brand surface are held or controlled through the project’s DAO / DAO LLC structure. This generally includes core repositories / codebases, on-chain smart contracts, trademarks / brand assets, domains, the official website, social accounts, and other project-created IP.

(b) Contract/admin powers

Governance authority is exercised through MetaDAO's decision market mechanism. Any token holder may create a proposal. To go live, holders must stake tokens on it as an anti-spam measure; staking carries no lockup and no risk of slashing. Proposals may spend USDC from the treasury, issue new tokens, update token metadata, and adjust treasury-provided liquidity. Only one proposal may be live at a time. No traditional quorum, majority, or super-majority voting threshold applies. Instead, authority is derived from market-based resolution. Upon activation, conditional PASS and FAIL markets open. Participants trade using the governance token or USDC. After a 24-hour delay, a lagging TWAP begins recording. A team-sponsored proposal passes when the PASS market TWAP exceeds the FAIL market TWAP by the applicable threshold; non-team-sponsored proposals carry a modestly higher threshold. Thresholds are set onchain and may be verified in the DAO's onchain configuration. Proposals that pass are executable on-chain without requiring additional approval. Emergency operations, such as contract pauses or urgent security responses, are not routed through the proposal market. These authorities may instead be assigned to a defensive multisig / security council or similar administrative role, where applicable. Such authority is generally limited to protective actions, such as halting interactions during an exploit,

• and does not include unilateral authority to modify core logic or move treasury assets except as expressly authorized by the governing contracts and legal documents.

(c) Locked-token rights (conditional)

No token locking or staking mechanism exists for governance participation. The filing instruction permits this section to be left absent where no locking mechanism exists; it is answered here for clarity. Governance operates through MetaDAO’s decision market mechanism. Rather than locking tokens to vote, participants trade on proposal outcomes using the governance token or USDC. A proposal passes when the market collectively signals it would increase token value; it fails when the market signals the opposite. Governance influence is proportional to capital committed, not to tokens locked. Through this mechanism, token holders can authorize treasury spend, token issuance, token metadata changes, and adjustments to treasury-provided liquidity. Emergency operations, such as contract pauses or urgent security responses, are not routed through the proposal market; those authorities are described in section 3(b).

(d) Value accrual & holder rights

UMBRA is an ownership coin. Value accrues to the token through governance authority over the DAO treasury and any protocol revenues. Proceeds compound into the treasury and are deployed pursuant to governance authorization. There is no standing automatic distribution to token holders; any distribution, buyback, or capital return requires a governance proposal to pass through MetaDAO's decision market mechanism. Token holders may raise a proposal at any time to authorize a return of capital. Governance operates through MetaDAO’s decision market mechanism. Rather than locking tokens to vote, participants trade on proposal outcomes using the governance token or USDC. A proposal passes when the market collectively signals it would increase token value; it fails when the market signals the opposite. Governance influence is proportional to capital committed, not to tokens locked. Through this mechanism, token holders can authorize treasury spend, token issuance, token metadata changes, and adjustments to treasury-provided liquidity. Market participants therefore influence protocol direction through the decision market itself, rather than through a separate lock-based voting system. Treasury sovereignty, including decisions regarding redistribution, reinvestment, or other uses of protocol surplus, remains subject to governance authorization through that mechanism.

(e) Dissolution authority

The DAO may be dissolved through a governance proposal passed via MetaDAO's decision market mechanism. No individual, team member, or external entity holds unilateral authority to wind up the DAO. A dissolution proposal follows the same proposal activation and TWAP-based resolution process as any other governance action. A successful dissolution proposal would authorize disposition of treasury assets and protocol IP as specified within the proposal.

Score: 5/5

(a) Entity

• PhoenixDAO LLC (Marshall Islands): This entity serves as the primary IP Holding Vehicle. It holds legal title to the protocol’s smart contracts, brand assets, trademarks, and associated codebases for the benefit of the DAO.
• Umbra Privacy Ltd. (BVI): This entity is designated for Operational Compliance, specifically managing Know Your Customer (KYC) procedures and related regulatory requirements.

(b) IP ownership & control

The DAO’s intellectual property and legal operations are managed through a dual-entity structure designed to separate protocol IP from administrative compliance:

• PhoenixDAO LLC (Marshall Islands): This entity serves as the primary IP Holding Vehicle. It holds legal title to the protocol’s smart contracts, brand assets, trademarks, and associated codebases for the benefit of the DAO.
• Umbra Privacy Ltd. (BVI): This entity is designated for Operational Compliance, specifically managing Know Your Customer (KYC) procedures and related regulatory requirements.
• DAO Control: While these legal wrappers exist for interface with legacy systems, ultimate control over the protocol IP remains subject to the DAO’s on-chain governance mechanisms.

(c) Powers over DAO/treasury

Under the Operating Agreement, the DAO possesses sovereign authority over the Treasury, but this power is exercised exclusively through Decision Markets rather than traditional voting.

• Method of Authority: Market Resolution (Futarchy). Proposals regarding treasury disbursements (grants, investments, or operational costs) are resolved by comparing the Time-Weighted Average Price (TWAP) of two conditional markets: "Pass" and "Fail."
• Threshold: There is no token-weighted majority or quorum. A proposal is automatically authorized only if the "Pass" market price exceeds the "Fail" market price by a pre-defined margin over the observation period.

(d) Powers over DevCo/Foundation

There is no traditional Foundation or DevCo exercising discretionary control over the protocol. PhoenixDAO LLC (Marshall Islands) acts solely as an IP holding entity, and Umbra Privacy Ltd. (BVI) performs compliance-related functions. Neither entity has authority to override governance decisions, access treasury assets, or modify protocol parameters. All material decisions are executed exclusively through on-chain governance mechanisms.

(e) Contract/admin powers

Administrative authority is entirely on-chain and automated, devoid of human-managed legal entities. We have a decentralized, "algorithmically managed" structure where decision-making is shifted away from humans to a technical mechanism.

• Governance-Executor: The "Owner" of all protocol smart contracts is a non-human Timelock/Governor contract.
• Method of Authority: This executor only triggers logic changes based on the automated output of the Futarchy decision markets.

Score: 2/2

(a) Launch supply totals

(b) Recipient categories & use of funds

Token Unlock Schedule for everyone remains the same with the TIme based & Performance based metrics.

(c) Initial price per token

$0.3

(d) Ticker / market symbol

$UMBRA

(e) Total supply & supply regime

• Total current supply is 28.5M, however only 15M of these is the unlocked supply
• New tokens will be minted post 18 months from TGE based on token performance to the team which includes an additional 13.5M

(f) Initial vesting / release schedules

Rights to the underlying value of the tokens are not absolute; they are earned in five equal tranches of 20%. Each tranche only becomes claimable upon the protocol reaching specific Fully Diluted Valuation (FDV) milestones (at 2x, 4x, 8x, 16x, and 32x multiples of the ICO valuation).

Score: 3/3

We have never conducted an airdrop to date and do not plan to execute one.

Score: 5/5

The protocol has no market-making agreements, token loans, or deals as of 15 February 2026.

Score: 5/5

We have no agreements with any CEX or DEX for a listing. No native-token listing fees have been paid to any exchange be it a CEX or a DEX. 20% of the USDC raised during the ICO was allocated directly to seeding the AMM liquidity pool, ensuring immediate tradability upon launch. This liquidity allocation was defined as part of the ICO terms and is not subject to separate market-making contracts or third-party liquidity provider agreements.

Score: 5/5

The MetaDao fundraiser was the primary Token Generation Event. No tokens were sold or distributed via private rounds, OTC, or to Market Makers prior or after this event. The MetaDAO Raise occurred from 10-14 October 2025.

(d) Initial vesting / release schedules

Rights to the underlying value of the tokens are not absolute; they are earned in five equal tranches of 20%. Each tranche only becomes claimable upon the protocol reaching specific Fully Diluted Valuation (FDV) milestones (at 2x, 4x, 8x, 16x, and 32x multiples of the ICO valuation).

Score: 2/2

No exploits affecting tokenholders or protocol funds as of 15 February, 2026.

Technology, Token Economics) To ensure the highest level of security, Umbra Privacy utilizes a "defense-in-depth" strategy that combines industry-standard mathematical proofs with ongoing professional reviews. Our security architecture is built on three pillars: provable cryptographic correctness, rigorous third-party auditing, and continuous ecosystem monitoring.

1. Provable Cryptographic Correctness (Circom & Noble) We rely on Circom for our zero-knowledge circuits and the Noble suite for our underlying cryptographic primitives.

• Audits & Verification: Both Circom and Noble are industry-standard toolchains that have undergone extensive professional audits and formal verification. Noble, in particular, is one of the most scrutinized cryptographic libraries in the ecosystem, designed specifically for auditability and constant-time execution.
• Near-Impossible Failures: Because these libraries are used by protocols securing billions of dollars in value, the likelihood of a "broken" primitive or a compiler-level bug is considered virtually zero in practice. These tools provide a foundation of mathematical certainty that the basic building blocks of our privacy logic are sound.

1. Professional Smart Contract Audits (Solana & Arcium) While our primitives are verified, the "glue" that connects them—our smart contracts and our MPC provider—requires bespoke security reviews.

• Ongoing Top-Tier Audits: Our core Solana smart contracts, along with the Arcium network’s MPC implementation, are currently undergoing comprehensive audits bytop-tier security firms including Halborn specializing in the Solana ecosystem. These firms focus on the unique complexities of our technology. Token Economics, Unlocks & Incentive Risks The DAO maintains comprehensive sovereignty over the protocol’s economic levers, managed through a decentralized and automated market-based system. Unlike traditional models, these powers are exercised via Conditional Decision Markets rather than discretionary voting. Regulatory, Legal & Tax Risks Token classification. The governance token may be classified differently across jurisdictions. If any regulator determines it constitutes a security rather than a governance or utility token, the project and token holders could face registration requirements, trading restrictions, or enforcement actions. The U.S. SEC’s evolving position on governance tokens, and parallel developments in the EU (MiCA), Singapore (MAS), and other jurisdictions, create ongoing uncertainty that the project cannot resolve unilaterally. Entity-level regulatory risk. The project operates under a Marshall Islands DAO LLC structure. While the Marshall Islands has adopted favorable digital asset legislation, this jurisdiction may face diplomatic, banking, or regulatory pressure that creates operational friction. Regulatory changes in any jurisdiction where the development team operates, token holders reside, or users access the protocol could impose licensing requirements, restrict operations, or compel structural changes to the DAO LLC or its governing arrangements. MetaDAO protocol dependency. The project’s governance infrastructure is provided by MetaDAO, which is currently in beta. MetaDAO’s documentation discloses that the MetaDAO team currently retains the ability to override decision markets in extreme scenarios. Changes to MetaDAO’s protocol, terms, or operational status could affect the project’s ability to conduct governance or complete token-related actions. Tokenholder tax treatment. The tax treatment of ownership tokens is uncertain and varies significantly across jurisdictions. Depending on jurisdiction, taxable events may include receipt of tokens at TGE, trading or transferring tokens, participating in governance markets, or receiving any future distributions authorized by governance. Token holders are solely responsible for determining and complying with their own tax obligations. The project does not provide tax advice and makes no representations regarding tax treatment. Jurisdictional access. Token holders and users are responsible for ensuring their participation complies with applicable laws in their own jurisdiction. The project makes no representation that holding or trading the token is lawful in any particular jurisdiction. Protocol, Technology & Security Risks Smart contract vulnerabilities. Logic errors or implementation flaws in the project’s on-chain programs could result in loss of funds or unintended behavior. No audit process eliminates all risk; vulnerabilities may exist that audits, internal review, or community testing fail to detect, including novel attack vectors that emerge after deployment. Solana runtime dependency. The project’s contracts execute on Solana. Changes to Solana’s compute limits, runtime behavior, validator set, or network stability could disrupt contract execution or proof verification. A Solana network outage or consensus failure would render on-chain governance and treasury operations temporarily inaccessible. MetaDAO decision market dependency. Governance, including all treasury actions and token issuance, is routed through MetaDAO’s decision market infrastructure. A bug, exploit, or operational failure in MetaDAO’s contracts could prevent proposals from being created, resolved, or executed, effectively freezing governance until the issue is resolved. Decision market liquidity and manipulation risk. Proposal markets rely on sufficient trading participation to produce accurate price signals. Thin liquidity in PASS or FAIL markets, particularly for smaller or less actively traded projects, could allow a single large participant to influence a TWAP outcome. MetaDAO’s lagging TWAP mechanism mitigates but does not eliminate this risk. AMM liquidity pool risk. A portion of ICO proceeds and tokens are deployed to an AMM liquidity pool at launch. Impermanent loss, pool imbalances, or low liquidity depth could affect the tradability of the token and the value of treasury-held liquidity positions. Token Economics, Unlocks & Incentive Risks Performance tranche unlock pressure. Team tokens, where applicable, unlock in tranches tied to price milestones (2x, 4x, 8x, 16x, and 32x of ICO valuation). Each milestone, if reached, creates a discrete unlock event that may result in selling pressure as recipients become able to claim and liquidate tranches. Governance can authorize new token issuance. Mint authority over the token sits with the DAO treasury, governed by MetaDAO’s decision market mechanism. A governance proposal that passes could authorize the issuance of additional tokens, which would dilute existing holders. Token holders cannot assume the current supply is a permanent ceiling. Governance participation risk. Decision markets require active, capitalized participation to function as intended. If governance markets are thinly traded, due to low token holder engagement, small float, or poor market depth, proposal outcomes may reflect the preferences of a small number of participants rather than the broader holder base. Apathetic or concentrated governance could lead to outcomes that are adverse to the majority of token holders. Treasury concentration risk. All ICO proceeds flow into a single on-chain treasury governed by decision markets. A successful malicious proposal, a smart contract exploit targeting the treasury, or a sustained period of governance dysfunction could result in partial or total loss of treasury assets with limited recourse. Protocol revenue assumptions. Value accrual to the token depends on the protocol generating meaningful usage and, over time, revenue that governance allocates toward token holders. If the protocol fails to attract sustained usage, the treasury will not grow beyond ICO proceeds, and there is no mechanism guaranteeing any return to token holders other than a governance-authorized liquidation proposal.