Security & trust

Controls in code

Launch fixtures revoke mint authority and never grant freeze authority. Custody enforces fixed recipients, protected budgets, token caps, exact account bindings, replay resistance and challenge windows. Unsafe single-wallet initialization is rejected in the deployable build. The old OTC settlement always fails closed.

The test suite executes compiled custody and the immutable Squads v4 binary in LiteSVM. It checks one-signer rejection, quorum delay, real cross-program invocation and replay rejection. Tests are not an independent audit or public deployment receipts.

Remaining trust

Agent reports can be wrong. Two signers can collude. A private key or a wallet address does not establish independence. Governance cannot cryptographically prove source ownership, honest invoices or useful work. Upgrades remain a custody risk until authority is irreversibly removed; upstream protocol authorities must also be disclosed.

The Rust dependency tree still includes unmaintained bincode through the Solana SDK. No clean scanner output is a proof against exploitation.

Deployment gates

No mainnet writes are enabled. Compatible trading infrastructure, verified e/acc quote-asset compatibility, published internal security review, remediated findings, verified builds, capped pilot monitoring and a properly funded bug bounty must precede production. No auditor, bounty funding or security guarantee is invented.