Security

If you can break it, tell us first.

xchange never holds funds. The contracts pay an order only to the other side of a match or back to the depositor; the coordinator key that names the other side is in scope too. There is a bounty.

In scope

Solana escrow program
9TwvUTeAP5q2CjkgrkUBDjqUR1PWJCvnXysSWxhnVvBZ
Gajumaru escrow contract
ct_qFFGpmX7bCbbRKHqwJxHcXF7x5NFtyfB5wHdvbc1dnejvPWpL, and the first one, ct_2og5SNPLZuShW2AjibnopfJ4bmgG5AkPm5DddV9T98XFvw2mf3
XGE mint
A27XtHmsXPUmroqetTc2Vso8VwPzgbAbLDRHQpFGGJs6
Apps
app.xchangehq.com, its API, the Telegram bot and the wallet code on your device

Verifiable on chain

  • XGE supply is 100,000,000, fixed; mint and freeze authorities are revoked.
  • xchange sells no XGE and sets no price. XGE leaves the rewards wallet only as rewards. The team's share belongs to the people who hold it: a grant stated as vesting is held until it vests, and the rest may be sold by them at any time.
  • The Solana program's security.txt points here.
  • Open and recent orders are checked against both chains daily, and a refund that has not landed is sent again.

Still to come

  • A second, independent check on the coordinator. Until then, that one key names the other side of every match on its own.
  • A multisig for Solana program upgrades. Today one key can upgrade it.
  • An outside audit of the contracts.

Reporting

Write to [email protected] with what you found and how to reproduce it. You will get a reply within two days.

Rules

  • Don't move or lock anyone else's funds; a write-up is enough.
  • Test only with your own accounts and wallets.
  • Give us time to fix it; we will agree a date.

What you get

  • No legal action for good-faith research under these rules.
  • Credit on this page, if you want it.
  • A reward in XGE for a confirmed vulnerability, in proportion to what it could have cost.

/.well-known/security.txt

Check it with a small swap

Every deposit, payout and refund links from your history to the chain.

Open the app