Audit and incident path

Audit

No third-party audit of the contracts or the Solana program has been published. Until one is, treat the protocol as unaudited software holding real funds, and size positions accordingly.

The contracts enforce the exposure ceilings listed in Contracts and addresses regardless of what the backend proposes, which bounds what a defect in off-chain code can reach. It does not bound a defect in the contracts themselves.

Reporting a security issue

Write to support@pools.markets with “security” in the subject. Describe the issue and how to reproduce it. Do not post exploitable details publicly before Pools Markets has confirmed a fix. A dedicated security address and a disclosure policy will be published here when they exist; until then this mailbox is the path.

Pools Markets will never ask for a private key, a recovery phrase, an exported key file or an email code in any channel.

Incident communication

Incidents that affect open markets, payouts or the wallet are recorded here with their effect and resolution.