Audit & Security
Trnch holds no user funds. Every swap is signed in your own wallet.
- 0
- funds held by Trnch
- 4
- audit passes, last release
- 6
- risk areas covered
- 570+
- automated tests on every build
Internal audit
- Threat model per risk areaAssets, entry points, trust boundaries and invariants (Pashov x-ray).
- Line-by-line reviewEvery entry point against those invariants, by independent AI audit passes (at least two per release).
- Replayed on production transactionsEach check replayed against real transactions from production before it ships.
- Every fix verifiedBy a fresh, targeted pass and by regression tests before release.
- Smart contractsPashov solidity-auditor and fuzz tests (fizz, Foundry) before any deployment.
- Done againOn every major change to the site, the API or the swap path.
Scope
Swap transactions
Every transaction a router returns is checked before you sign: the contract it calls and the contract you approve must be on a closed list per router, on our server and again in your browser. The calldata of every swap is read back: the token sold, the token bought, the amount taken, the minimum received and the recipient must match your request. Uniswap permits only for Permit2 and its Universal Router. Approvals are for the exact amount. Fees can only go to the Trnch treasury Safe.
Bot API and MCP
API keys are created by a wallet signature bound to trnch.fun, valid once and for 10 minutes. Keys are stored hashed. Calls are rate limited per key and per IP.
Secrets and data
Database admin access and signing keys stay on the server. No secret is exposed to the browser.
API inputs
Every API input is validated against a strict schema before it is used.
Smart contracts
Trnch has no deployed contract holding funds. Any contract is audited with the Pashov Solidity tools and fuzz tested before deployment.
Routers and their audits
Credits
- Pashov Audit Group, skills: x-ray threat modeling, solidity-auditor and fizz fuzzing procedures (MIT).
- z0r0z, majeur: multi-pass, multi-tool review and published audit scope.
Found a security issue? Contact us.