Security

Don’t trust us.Check.

Every protection in Qalibre is enforced by code you can read and contracts you can verify, not by a promise.

Your keys, on your phone

Your wallet is a smart account owned by a key created on your device and encrypted with your PIN. Qalibre never sees it. Back it up and you can use your wallet anywhere, without us.

A narrow permission

Qalibre trades with a separate key that can only settle orders into your own wallet, for tokens you approved, within per-trade and daily limits enforced by the contract. It cannot withdraw. You can revoke it at any time.

An on-chain price floor

Before a trade settles, the settlement contract asks the exchange what a direct swap would pay. If your fill is lower, the whole batch is refused. No server, including ours, can override it.

A real safety check

Tokens are test-bought and test-sold on the live chain without spending anything, and their code is scanned for minting, pausing, blacklists and upgradeability. It runs again at the moment you buy.

Slow changes, fast exits

Adding a trading venue or raising a fee waits 48 hours and is public on-chain before it applies. Removing a venue or lowering a fee takes effect at once.

Honest limits

A safety check reduces risk; it cannot promise a token is good. We are on testnet until an external audit is complete. Both are said plainly, everywhere.

Verified contracts

Read the codethat holds the rules.

Each contract below is verified on the QMS Explorer, so its source matches what runs. The full code, tests and our internal audit, including what is still open, are public on GitHub.

Report a vulnerability

Found something?Tell us privately.

Email security@qalibre.app or open a private security advisory on GitHub, with the steps to reproduce. Please don’t post it publicly until it is fixed. We reply to every report.