Security

xchange never holds your funds. Your keys stay on your phone, and trades settle through escrow contracts that can only pay the other side of the trade or refund you. If you find a way to break that, tell us first.

In scope

• Solana escrow program 9TwvUTeAP5q2CjkgrkUBDjqUR1PWJCvnXysSWxhnVvBZ
• Gajumaru escrow contract ct_qFFGpmX7bCbbRKHqwJxHcXF7x5NFtyfB5wHdvbc1dnejvPWpL (and the first one, ct_2og5SNPLZuShW2AjibnopfJ4bmgG5AkPm5DddV9T98XFvw2mf3)
• XGE token, mint BrvPG8UypLx87u488qC82g8vS9DQAS4V3rh7U5UBkuz5
• app.xchangehq.com, the API behind it, and the Telegram bots
• The wallet code that runs on the phone

Reporting

Open a private advisory on GitHub: github.com/xchange-hq/xchange/security/advisories/new. Or contact Thandile Nododile, who built xchange and maintains it: Telegram @nododile, X @nododile_, Instagram @nododile_, GitHub @nododile.

Include what you found, how to reproduce it, and what it could do. You will get a reply within two days.

Rules

• Don't move or lock anyone else's funds to prove a point. A write-up is enough.
• Test with your own accounts and wallets, not other people's.
• Give us time to fix it before going public. We will agree a date.

In return

• No legal action for research done in good faith under these rules.
• Credit on this page if you want it.
• A reward in XGE for a confirmed vulnerability, in proportion to what it could have cost.

Verifiable on chain

• XGE supply is 100,000,000, fixed. Mint and freeze authorities are revoked.
• xchange sells no XGE and sets no price. 10% went to the founder; the rest leaves the rewards wallet only as rewards.
• The Solana program carries a security.txt pointing here. Contract source is shared with researchers on request until the repository is public.

/.well-known/security.txt