Security & audit status
Trust in a trading protocol should rest on what's verifiable, not on reputation. Here's exactly what backs that claim today, and where the gaps still are.
What's real today
- Provably fair execution. Every fill is seeded per account and independently reconstructible; on verified evaluation templates, an internal fidelity audit confirmed the engine introduces no directional edge against the trader. Details in How trading works.
- On-chain, checkable settlement. Trade history is committed into hourly, cryptographically verifiable batches. A fraudulent settlement isn't just against policy, it's provable and challengeable. Details in On-chain architecture & trust.
- A real economic penalty for cheating. Every firm's operator posts a slashable collateral bond. A proven fraud costs the operator that stake and pays whoever caught it.
- Devnet-proven, not just code-reviewed. Core mechanisms, settlement, payouts, the , the , have been exercised against real deployed programs on Solana's devnet with real, verifiable transactions, not just reviewed as source code.
- Internal adversarial review. The protocol has been through repeated internal red-team passes across its on-chain programs, hunting specifically for drain vectors, fraud paths, and economic exploits, with findings tracked and fixed as they're found.
What's not there yet
The on-chain programs have not yet been through an independent third-party security audit. A formal external audit is planned, funded from protocol revenue, but it has not started as of this writing. Until it's complete, the safeguards above, internal review, devnet-proven testing, and the on-chain slashing deterrent, are the only controls in place. There is no additional compensating control standing in for a third-party audit today.
This is stated plainly because it should factor into how much capital anyone puts at risk, both traders and firm operators, before that audit completes. It is not a reason the protocol can't be used; it is a fact anyone using it should know.
For the wider picture of what's proven versus merely reviewed, and what still stands between devnet and mainnet, see What's live today. The whitepaper carries the same audit status in §15, alongside the oracle failure modes and keeper-liveness assumptions the protocol depends on.