Your wallet is a smart account owned by a key created on your device and encrypted with your PIN. Qalibre never sees it. Back it up and you can use your wallet anywhere, without us.
Security
Don’t trust us.Check.
Every protection in Qalibre is enforced by code you can read and contracts you can verify, not by a promise.
Qalibre trades with a separate key that can only settle orders into your own wallet, for tokens you approved, within per-trade and daily limits enforced by the contract. It cannot withdraw. You can revoke it at any time.
Before a trade settles, the settlement contract asks the exchange what a direct swap would pay. If your fill is lower, the whole batch is refused. No server, including ours, can override it.
Tokens are test-bought and test-sold on the live chain without spending anything, and their code is scanned for minting, pausing, blacklists and upgradeability. It runs again at the moment you buy.
Adding a trading venue or raising a fee waits 48 hours and is public on-chain before it applies. Removing a venue or lowering a fee takes effect at once.
A safety check reduces risk; it cannot promise a token is good. We are on testnet until an external audit is complete. Both are said plainly, everywhere.
Verified contracts
Read the codethat holds the rules.
Each contract below is verified on the QMS Explorer, so its source matches what runs. The full code, tests and our internal audit, including what is still open, are public on GitHub.
- Settlement0x8812…19F4
- Wallet factory0xC443…7154
- Wallet implementation0xa82F…3E20
- QWAP adapter0xDfAf…b414
- Gas sponsor0xd8f6…0f8C
Report a vulnerability
Found something?Tell us privately.
Email security@qalibre.app or open a private security advisory on GitHub, with the steps to reproduce. Please don’t post it publicly until it is fixed. We reply to every report.