Security
Risk The program has been tested locally only and is not deployed. The checks below limit what can go wrong. They do not rule out bugs. See Risks.
Rules checked on every money move
At the end of every action that moves money, the program checks two things. If either fails, the whole transaction fails.
- The vault holds at least the house balance plus every open margin.
- The house balance covers everything set aside for open winners.
On top of that: a margin can only go back to its owner, or to the vault on a loss or liquidation. Every open sets aside its max profit first. No pause, setting or limit can block a close, a liquidation or a withdrawal request. Rounding always favours the vault.
Tests
272 tests: 231 on the program, 41 checking the app's math against the program's.
- Trades, caps, the daily loss limit, the skew fee, listing, limit orders, TP/SL and partial closes, on both vaults.
- Vault deposits and withdrawals, including deposits and withdrawals timed around a known win or loss.
- A random loop of trades, liquidations, deposits, withdrawals, settles, setting changes and violent prices that re-checks every rule and every unit of SOL after each step.
- Wind-down: every depositor paid through the queue after the last position ends.
Security reviews
The program went through 2 security reviews. Every attack they found is replayed as a test that must fail: 32 replays.
| Found | Fixed by |
|---|---|
| A price record squeezed between swaps could set the price | records stand alone, spaced in seconds, capped per step, averaged |
| A position could open already liquidatable | open price checks, start well above the line, liquidation needs both prices |
| The team could freeze closes through price settings | settings are checked, and changes that add risk wait a public 6 h delay |
| Losses could stack across the daily limit's window | rolling hourly history |
| Splitting an open lowered the skew fee | fee measured over the whole trade |
| The depth cap was not tied to the pool fee | cap limited by the pool's fee |
Attack tests on real pools
The strongest known price attacks run against the compiled program on real pump.fun pools, including thin ones down to the 30 SOL floor, over a grid of attack sizes, with the attacker paying the real swap fees. Every run loses money for the attacker at launch settings, also when the attacker is the coin's creator.
What the team can and cannot do
The team can: propose setting changes, within hard limits written in the program, which apply at once when they reduce risk and otherwise only after a public 6 h delay, and never touch open positions, resting orders or queued withdrawals; pause opens for the whole app, a vault or a market; open or close public vault deposits; create a new collateral vault; replace the operator key; withdraw the operator fee and the buyback treasury.
The team cannot: touch traders' margins or depositors' shares (there is no admin access to traders' margins or depositors' shares); block closes, liquidations or withdrawal requests; change an open position's terms; skip the delay.
The operator bot can: list coins that pass the on-chain checks; set a market close-only; record prices; run the daily settle; spend treasury SOL only in a transaction that burns $LEVER worth at least 90% of it, within 10 SOL a day.
The operator bot cannot: touch margins, the vault, the pauses or any setting.
Upgrades
Until the program is frozen, whoever holds the upgrade key can replace the code.
- Launch with low caps. The upgrade key is a Squads multisig, not one person.
- Upgrades go through a Squads multisig with a 6 h time lock, so each is public on-chain before it can land.
- After a test period, the upgrade key is removed and the program frozen.
- Until then, the site shows the upgrade status.
Reproducible build
Reproducible build; source available to auditors on request. The program carries a security contact on-chain.
HYPE bridge risk
HYPE on Solana is bridged. If the bridge were broken, fake HYPE could be posted as margin to win real HYPE from the HYPE vault. The team can pause opens on that vault at once, its caps are small, and it is fully separate from the SOL vault.
Not covered yet
- A review by an external security firm.
- A devnet run with the price bot live.
- Buybacks swapped inside the program, and HYPE buybacks.