Set a price to buy, a price to sell, a price to stop. They are encrypted in your browser and evaluated by a network where no single node holds them whole.
on-chain Pyth account 7UVimffx…pjLiE
OLDER THAN THE 30-SECOND LIMIT THE PROGRAM ENFORCES — IT WOULD REFUSE TO TRADE ON THIS. DEVNET PUBLISHES LESS OFTEN THAN MAINNET.Three prices go in. They are sealed in your browser.
buy under · sell over · stop below
The trade is public on Solana. The three prices are not.
Real SOL candles, last 24 hours, relayed from Pyth by this site’s own server.
This rule would have fired 0 times in the last 24 hours.
A COUNT OF PAST CROSSINGS IN THE WINDOW SHOWN — NOT A BACKTEST, NOT A RETURN, NOT A PROJECTIONThis is one filled trade, as the chain records it.
Seven fields anyone can read. Three they cannot — encrypted in your browser, and evaluated by a cluster where no single node holds one whole.
Every fill is a labelled inequality. Enough of them narrow the three prices. Unread, not unknowable.
No instruction in the deployed program accepts an operator authority.
A TEST FAILS IF THAT CHECK IS REMOVED (T-1, T-5) · TRUE OF THE DEPLOYED CODE — SEE CARD 1 BELOWThe vault is a program-derived account. Deposits, limits and every enforcement rule are on chain, because that is the only place they cannot be quietly changed.
Your three prices are secret-shared across an MPC cluster and evaluated without any single node holding them whole. The result comes back signed by the whole cluster.
An on-chain price account the program validates for staleness and confidence before it can influence anything. Not the chart — the chart is a display feed.
A pinned program id, called through a CPI with a slippage floor derived from the oracle, and three balance assertions after the swap returns.
Counted from the repository, not asserted
Grades and threat IDs from SECURITY.md
The upgrade authority is a single hot keypair, Cbdvwy6D…kbpTZ, and every other line on this site is conditional on it.
SECURITY.md, the gaps that matter #1. Verified live, not assumed: solana program show reports that authority and the account is system-owned — a plain keypair, not a multisig.
Solana is a public ledger, every fill is a labelled inequality, and enough of them narrow the three prices behind them.
SECURITY.md T-9 — inherent and unfixable. Bounds tighten roughly logarithmically: days, not years, for an active bot. Sharpened by T-38 and T-39. Unread, not unknowable.
Using it would halt every bot loudly and publicly on chain and cannot forge a trade, but it could decrypt strategies already stored.
SECURITY.md T-7 — partially mitigated. Cluster pinning makes a migration halt the system loudly. Ciphertext already published on chain stays decryptable, because anything the MXE computes on, the MXE key decrypts, and on-chain data is permanent.
Arcium’s one-honest-node guarantee is their published property, reproduced here, and nothing in this repo can verify it.
SECURITY.md, what this audit does not cover: the Arcium privacy claim (1-of-n honest) is a vendor property reproduced from their documentation, not something this project can verify. No third party has reviewed any of this.