Audit & Security
Trnch holds no user funds. Every swap is signed in your own wallet.
- Funds held by Trnch
- 0
- Audit passes, last release
- 4
- Risk areas covered
- 6
- Automated tests on every build
- 570+
Internal audit
- Threat model per risk area: assets, entry points, trust boundaries and invariants (Pashov x-ray).
- Line-by-line review of every entry point against those invariants, by independent AI audit passes (at least two per release).
- Each check replayed against real transactions from production before it ships.
- Every fix verified by a fresh, targeted pass and by regression tests before release.
- Smart contracts: Pashov solidity-auditor and fuzz tests (fizz, Foundry) before any deployment.
- Done again on every major change to the site, the API or the swap path.
Scope
Swap transactions
Every transaction a router returns is checked before you sign: the contract it calls and the contract you approve must be on a closed list per router, on our server and again in your browser. The calldata of every swap is read back: the token sold, the token bought, the amount taken, the minimum received and the recipient must match your request. Uniswap permits only for Permit2 and its Universal Router. Approvals are for the exact amount. Fees can only go to the Trnch treasury Safe.
Bot API and MCP
API keys are created by a wallet signature bound to trnch.fun and chain 4663, valid once and for 10 minutes. Keys are stored hashed. Calls are rate limited per key and per IP. Tokens TIA keeps out of the Heat cannot be traded through the API.
Payout signing
The payout key never leaves its signing service. The service reads every transaction before signing and only signs USDG transfers on Robinhood Chain, with caps per transfer, per day and on gas.
Secrets and data
Database admin access and signing keys stay on the server. No secret is exposed to the browser.
API inputs
Every API input is validated against a strict schema before it is used.
Smart contracts
Trnch has no deployed contract holding funds. Any contract is audited with the Pashov Solidity tools and fuzz tested before deployment.
Routers and their audits
| Router | Audits | Reports |
|---|---|---|
| KyberSwap | Hexens, Hacken, Omniscia, Spearbit | View |
| 1inch | Consensys, Decurity, Hexens, OpenZeppelin, PeckShield, Pessimistic | View |
| Uniswap | Universal Router audit reports | View |
| LI.FI | Contract audit reports | View |
| Sushi | Security program and Immunefi bug bounty | View |
| 0xPaused on Trnch for now | OpenZeppelin, Dedaub, Bailsec | View |
Credits
- Pashov Audit Group, skills: x-ray threat modeling, solidity-auditor and fizz fuzzing procedures (MIT).
- z0r0z, majeur: multi-pass, multi-tool review and published audit scope.
Found a security issue? Contact us. TIA decisions are public on the TIA track record.