Security & Audits

← Back to index

Audit status

ZecPad's on-chain program has not yet been audited and is not deployed to mainnet-beta. This page will be updated with the auditor's name, scope, report, and remediation status as soon as an audit is complete. Until then, treat any pre-release build (devnet or otherwise) as unaudited software: funds and tokens used against it should be treated as at risk.

Planned audit scope, ahead of any mainnet deployment, covers at minimum:

  • Bonding-curve math (buy/sell) — integer overflow, precision loss, and rounding-direction exploits in the constant-product calculation.
  • Migration flow — front-running of the migration threshold, correctness of the CPI into the DEX pool-creation instruction, and mint-authority revocation.
  • Privacy Mode setup — correct initialization of the Confidential Transfer extension; incorrect setup here risks permanently inaccessible balances, not just a privacy failure.
  • Admin instructions — privilege escalation, missing has_one / constraint checks on treasury and authority accounts.
  • Anti-bot logic — bypass vectors, including the known limitation that per-wallet limits do not prevent splitting a buy across multiple wallets.

We intend to engage a firm with a Solana/Anchor track record (for example OtterSec, Neodyme, Zellic, or Trail of Bits) before mainnet deployment, with a public report linked from this page.

Upgrade authority

Two states are possible for a deployed Anchor program's upgrade authority, and they mean very different things for how much trust you're extending to the ZecPad team by using it:

StateWhat it means
Held by a multisigA defined set of keyholders (e.g. via Squads) must jointly approve any program upgrade. Safer than a single key, but still allows the program's logic to change after you've interacted with it.
Burned / set to NoneThe program is permanently immutable — no one, including the ZecPad team, can ever upgrade it again. Maximizes trust minimization; also means any bug found post-launch cannot be patched in place and would require a new deployment.

Current plan: ZecPad will launch with upgrade authority held by a multisig for an initial period to allow rapid fixes if an audited-but- unforeseen issue surfaces, with a committed timeline (to be published at mainnet launch) to burn the authority once the program has operated without incident. The exact multisig signers and burn date will be published here and on ZecPad's official channels before mainnet launch — do not trust an announcement of this made anywhere else.

Bug bounty

A bug bounty (planned via Immunefi) will open once the initial audit is complete, covering the deployed mainnet program. Until a formal bounty program exists, please report suspected vulnerabilities responsibly:

  • Do not disclose the issue publicly (including on social media or in public GitHub issues) before it has been triaged.
  • Do not test findings against mainnet with real funds beyond what's strictly necessary to demonstrate the issue.
  • Contact details for responsible disclosure will be published here and in the project's repository SECURITY.md ahead of mainnet launch.

Next

  • Common questions about how this affects you: FAQ