Security

Reporting a vulnerability

Use GitHub private vulnerability reporting, which reaches the maintainers privately and allows a fix to be prepared before anything is public. Please do not open a public issue or pull request for an unpatched vulnerability, and please do not test findings against live markets — the repository ships a command that gives you a full local chain with markets on it.

What has been checked

Counts are deliberately not reproduced here, because a number copied onto a page goes stale without anybody noticing. The repository's security document carries them and the commands to reproduce every line.

• Unit and integration tests across the contracts and the TypeScript packages.
• Property fuzzing, and invariants run to depth.
• Differential tests: every value computed in both Solidity and TypeScript is asserted against shared vectors, with expected values from a third naive implementation, so a shared misconception cannot pass.
• A committed gas snapshot and a coverage floor, both enforced in continuous integration.
• An end-to-end proof against a real chain and a real indexer, asserting that contract state and indexed data agree.
• Deployment evidence: every published address, code hash and size checked against the chain.
• Static analysis on every push, with every suppression argued for in writing rather than silenced.

Source verification

The deployed contracts are verified on Blockscout, so an explorer shows this repository's source rather than bytecode. Etherscan does not index this chain, so verification is Blockscout only. This deployment's explorer is robinhoodchain.blockscout.com.

Immutable by design

These are descriptions of what the deployed code makes impossible, not statements of intent. No contract can be upgraded or replaced, because there is no proxy anywhere. No more of a launched token can be minted. A market's fee schedule cannot be changed after creation, and its fees cannot be redirected. A launch position cannot be withdrawn. There is no pause, no freeze, no blocklist and no transfer tax, because none of those functions exist.

What this interface itself can do

Separately from the contracts, this application is constrained by tests that run in continuous integration and fail the build:

• It constructs no signer of its own and reads no private key, mnemonic or secret out of its environment. Where a transaction is signed, it is signed by your wallet, by you.
• It exposes no route that writes and declares no server action, so there is no path by which it acts on your behalf.
• It hardcodes no address, hash, ticker or amount. Every value it renders is read from the registry or the indexer at request time — a test scans the source for literals and fails on any it finds.

What this depends on and does not control

• Uniswap v4. A bug there is a bug in every market here.
• The chain's sequencer, which orders transactions. It can censor or reorder; it cannot forge state.
• Tokenized equity issuers, for markets quoted in one. The quote asset keeps its issuer's transfer and redemption controls, which cannot be overridden here.

Scope

In scope: the contracts, the construction of transactions, and any way this interface can be made to build a transaction that does something other than what it displayed.

Out of scope: vendored Uniswap and OpenZeppelin code, which should be reported upstream; the behaviour of tokenized equity issuers; chain-level sequencer behaviour; and the market risk of any particular token. A token going to zero is not a vulnerability.