Security

Vault program

• Program ID: 2yqKe7C2RZhYgfomfFZGXMLkHqencay1ZxiT8pWFT7Zx
• Network: Solana mainnet
• Upgrade authority: the owner wallet GZBAKKFJS9giRgzUsAXYYyxWDyLmREtHmbbLnbxdzVNE. The program can be upgraded by that wallet; every upgrade is a public on-chain transaction
• Audit status: not audited yet. It has an automated test suite, but no third-party audit

Custody rules

• No server or pod key holds user or treasury funds
• Deal Vault escrows, the pool and bond inventory are held by the program, not by a person
• Every transaction is built by the server, shown to you decoded, and signed in your own wallet; a tampered transaction is rejected
• Actions that move treasury funds must be signed by the treasury wallet

Streamflow

Staking and USDC reward payouts use Streamflow's staking and reward-pool programs on Solana, which are separate from the collective's vault program.