Security

​

Enforced on chain

• Only allowlisted executors and BlinkBridger callers move float; only the owner withdraws it. Neither is limited in amount or destination: any executor can refund any amount the escrow holds to any address and pay any amount of float to any address, and the owner can withdraw any amount from both vaults. The router and BlinkBridger (the rebalancing contract, which lets any caller on its own allowlist send any amount of solver float into an allowlisted bridge or swap contract with calldata that caller chooses, including the recipient) are registered executors too. On Solana and Sui the float sits in the treasury account, so the treasury key can send it anywhere and can refund any amount of the escrow’s deposits to any address.
• Swap outputs are checked against the minimum passed in the call. On a fulfillment the operator supplies that minimum; the contract does not check it against the quote.
• Swap output above the output amount passed in the call stays in the solver vault.
• Vouchers require a valid signature from the registered signer and redeem exactly once, only to the referrer address they name.
• No operator wallet holds a standing allowance on user funds (a Sui swap-first deposit grants the swap executor an allowance for exactly the quote’s expected_amount_in that expires within five minutes and can be spent only through the package’s source swap), and payouts come from the vaults’ own balances. On EVM chains escrow funds leave only through a release to the solver (which forwards the referrer share to the fee manager), an executor refund, or an owner withdrawal; on Solana and Sui escrow deposits leave only through a release, which pays the treasury and moves the referrer share into the voucher vault, or a treasury refund, unless the program or package is upgraded. None of these checks that the deposit has settled, which the operator and the signer cluster enforce off chain. The Sui escrow object also holds the voucher float, which leaves only through voucher redemptions and treasury defunds, unless the package is upgraded.

​

Depends on the operator

• Custody of float on every chain.
• Quote pricing and which pairs are offered.
• Timely submission of fulfillments and refunds.
• The owner keys that can pause, withdraw, and change allowlists.

​

Reporting a vulnerability

​

Integration hygiene

• Keep API keys server-side. A key in a shipped bundle is your rate limit and your attribution in someone else’s hands.
• Never put a partner session token in a client. It grants key management and referral claiming.
• Treat order state as the only settlement authority. A transaction hash means submitted, not confirmed.
• Show min_amount_out, not just amount_out, before a user signs.
• Fetch swap instructions immediately before sending a deposit; stale routing calldata is the most common cause of a failed deposit.