Security

Audit status

No independent audit has been performed. The program has unit tests for its accounting logic and an internal review. There are no audit reports, partnerships or certifications to show. A mainnet deployment should wait for at least one independent audit.

What protects funds

• Only a recipient's own wallet can withdraw that recipient's balance. No server key exists in the withdrawal path.
• The program has no protocol fee and no instruction that lets the admin move user funds.
• Split changes first distribute pending fees under the old split; recipients with a balance cannot be removed; a config nonce rejects stale updates.
• All arithmetic is checked; splits use 128-bit intermediates; rounding dust is carried, never lost.
• PDAs are validated by seeds and bumps on every instruction; withdrawals cannot drop the project below its rent floor.

Trust assumptions

• Program upgrade authority can change the program. It should be a multisig (e.g. Squads) with a timelock, or be revoked once stable.
• Protocol admin can pause distributions and, separately, withdrawals. A malicious admin could freeze funds (not steal them). Use a multisig.
• Project authority can change future splits until locked.
• The website builds transactions for you; always review them in your wallet. The database is a cache and convenience layer only.

Web application controls

• Wallet sign-in with single-use, expiring nonces; HTTP-only, SameSite=Strict session cookies; server-side session revocation.
• Same-origin checks on every mutation, Zod validation of every input, request size limits, Postgres-backed rate limits.
• Idempotency keys on create endpoints; database transactions; audit log of sensitive actions with salted IP hashes.
• On-chain claims (project creation, withdrawals) are re-verified against the chain by the server; client-reported amounts are never trusted.
• Content-Security-Policy, HSTS, frame denial, no secrets in the client bundle.

Report a vulnerability

Please report privately before disclosing. Email the maintainers at the security contact published in the repository's SECURITY.md (placeholder — the owner must set a monitored address before launch). Include steps to reproduce and the affected cluster/program ID. We aim to acknowledge within 72 hours. Do not test against other users' funds or run denial-of-service tests.

No bug bounty is currently offered.