You have to dig into the Wiki: > Formally-verified crypto > orion uses the formally-verified field arithmetic generated by fiat-crypto, for the underlying Cur

You have to dig into the Wiki: > Formally-verified crypto > orion uses the formally-verified field arithmetic generated by fiat-crypto, for the underlying Curve25519 operations. But the README has a big fat use at your own risk warning so that should probably take precedence.