Security
betaAudit status, security measures, and responsible disclosure
Audit Status
No vulnerabilities enabling direct fund theft were found. All critical and high-severity findings have been remediated.
Deferred (infrastructure changes)
CI / CD Pipeline
Every push and PR runs lint, typecheck, 317 tests, CodeQL analysis, dependency audit, and license compliance.
Security Measures
Non-Custodial
Private keys are generated and stored locally, encrypted with AES-256-GCM and scrypt KDF. We never have access to your keys.
Transaction Simulation
All transactions are simulated (dry-run) before signing. Move abort codes are mapped to user-friendly error messages.
On-Chain Governance
Fee changes require a 7-day on-chain timelock. Fees are hard-capped at 5% in the smart contract. Two-step admin transfer.
Price Circuit Breaker
Gas sponsorship is automatically paused when SUI price moves >20% in one hour, preventing oracle manipulation.
Automated Scanning
GitHub Actions pipeline runs CodeQL static analysis, dependency audits, and license compliance checks on every push and weekly.
Test Suite
317 tests across 20 files covering unit, integration, and adapter compliance — including multi-protocol orchestration edge cases.
Responsible Disclosure
If you discover a security vulnerability, please report it responsibly. Do not open a public GitHub issue.