Security

Security practices, audit reports, and responsible disclosure policy

Security

Security is fundamental to everything we build. We treat user funds as uninsured and design systems accordingly.

Security Model

Non-Custodial

We never hold user funds

Stateless Services

No user data stored server-side

Open Source

Critical components are open source

Continuous Auditing

Regular security reviews

Client-Side Security

All sensitive operations happen in your browser:

// Private keys never leave the browser
const signedTransaction = await wallet.signTransaction(transaction);

// Only signed transactions sent to services
await fetch('/api/broadcast', {
  body: JSON.stringify({ signedTransaction })
});

Security Properties:

• Private keys remain in wallet extension
• Transactions signed locally
• Services only see signed transactions
• No ability to access user funds

Routing Layer Security

1. Ephemeral Addresses

   Fresh, single-use deposit addresses with cryptographically secure randomness

2. Time-Limited

   Addresses expire after 24 hours with automatic refunds

3. Atomic Processing

   Operations complete atomically or fail completely

4. Monitoring

   Real-time monitoring with automated alerting

Audit Reports

Trail of Bits (March 2026)

Scope: Smart contract architecture and client-side security
Findings: 2 medium, 5 low severity (all resolved)

Kudelski Security (January 2026)

Scope: Cryptographic implementation and privacy model
Findings: 1 medium, 3 low severity (all resolved)

Bug Bounty Program

Severity	Reward Range
Critical	$10,000 -$50,000
High	$5,000 -$15,000
Medium	$1,000 -$5,000
Low	$100 -$1,000

How to Report

1. Contact: Via GitHub security advisories
2. Response: Within 48 hours
3. Timeline: 90 days for resolution

Best Practices

Wallet Security

Use hardware wallets when possible

Verify Addresses

Always double-check recipients

Monitor Transactions

Track status on Solscan

Keep Updated

Use latest wallet versions