Security

How to check you are in the right place, and what is actually protecting your money.

What is protecting your money, and what is not

Two kinds of thing are on this list and each one says which it is: what you can read off the chain yourself, and what you are taking from us because our source is not published. We would rather draw that line ourselves than have you find it.

• How much of your money our code can ever be holding, and for how long. One coin's curve holds at most the raise its creator picked. On the smallest tier that is about 9.18 SOL — the whole curve, every buyer added together — and it is fixed in SOL the moment the coin starts cooking. At graduation that SOL leaves our program: it becomes an ordinary Raydium pool with the liquidity locked permanently, and from that point nothing about your position depends on our code at all. You are trading a normal pool on a DEX you already use. A creator's own money at risk is smaller still: a refundable spam bond, shown before they sign, plus whatever they choose to buy, capped per account.
• The two things we are not rounding off in the bullet above. First, there is no deadline. Most coins never graduate, so for most coins that SOL sits on the curve until the people holding it sell. "Brief" is true for a coin that graduates and false for one that does not. Second, this bounds one coin, not us. There is no limit on how many coins exist and there is no deposit cap, so what our program is holding in total at any moment is whatever the market does, and nothing in the code bounds it.
• It is a beta. A bug could lose everything it holds, and there is no limit on how much that is.
• The upgrade authority is a 2-of-3 Squads multisig. With a one-person team, treat that as one person's control.
• A pause switch, and a monitor that can pull it without us. An off-chain monitor checks the program's invariants every block and can pause it on its own. The key it holds can only ever set pause flags: it cannot unpause and it cannot move funds. Only the multisig can unpause. Split into what you can and cannot check: the guardian key and the pause flags are fields in the program's config account, so you can read which key it is and whether the program is paused right now — but that a monitor is watching at all, and that its key is limited to flags, is our word rather than your check.
• A public bug bounty. Anything that moves user funds incorrectly pays out. Terms and where to send it are at the bottom of this page.
• We cannot charge you a fee you did not see. Every buy and sell you sign names the highest fee that transaction will accept, counting both rates a coin can carry — ours and the coin creator's. If either differs from what you read, the program fails the trade rather than charging you the difference — and the fee always comes out of the amount you signed for, never on top of it. That argument is in the program's public interface, so you can check it in any decoded transaction without taking our word for anything.
• The graduation fee on your coin is fixed the moment it starts cooking. 3% of the SOL raised on every tier except the smallest, which is 5%, copied into the coin's own on-chain record — so changing the table later cannot re-price a coin that already exists. This one you can check yourself: read the fee on your coin's record and compare it with the live tier table in the program's config account. If they ever differ, your coin keeps its own. Plainly, what we could still do: change it for new coins, up to the program's 20% ceiling on that fee. What we cannot do is change yours.
• Liquidity is locked permanently at graduation. Nobody can pull a graduated coin's liquidity — not the creator, not us. We keep the fee key and earn from pool volume; we cannot withdraw the pool. The caveat we say rather than hide: the lock is Raydium's Burn & Earn program, not ours. You can verify on chain that we called it and that the LP is gone; you cannot read that program's source, because it is not public.
• No key of ours can withdraw the SOL in a curve, and this is our word rather than your check. It leaves only through a buy, a sell, a refund, a claim or a migration, each to an address the program fixes. The upgrade authority is the exception, and that is what the multisig is for. What you can do for yourself is watch: every lamport that has ever moved in or out of a curve is a transaction on chain, and you can read them all. What no amount of watching shows you is what the code cannot do, because our source is not published — so this one is a claim you are taking from us, exactly like the fee bullet below it.
• A coin's creator fee can never be re-priced, and this is our word rather than your check. A creator picks their own cut of every curve trade the moment it starts cooking — 0 on almost all of them — and from then on nobody can change it: not them, not an admin key of ours, not a multisig vote short of replacing the program. It goes to the creator's own wallet and it never passes through us. What you can do for yourself is narrow: read the rate on the coin, and see it charged unchanged on every trade after it. What you are taking from us is that there is no instruction that could move it, because our source is not published. It is last on this list for that reason.
• Every control above is our own, paid for by us. Nobody outside this team is standing behind any of it.

Reporting something

The program carries a security.txt contact compiled into its binary — read it off the program on chain rather than trusting this page. Otherwise mail security@trenches.cooking. We run a public bounty: critical findings pay 10% of the funds at risk, minimum 5 SOL, maximum 100 SOL, from the treasury. Please do not test against mainnet with anybody else's money.

See also the risk disclaimer and the fees page.