Security review in progress
Security review in progress: internal review rounds are under way and an external audit is being arranged.
Review status,stated as it stands
Security review in progress: internal review rounds are under way and an external audit is being arranged. Mainnet deployment follows the review rounds and one complete verification run; the external audit may not be complete by then, and its results are published when it is.
Testing,per launch path
RTP Curve Launch
- 473 passing tests in 107 suites, plus fork suites run separately
- Invariants at 102,400 calls
- Mutation testing of every changed line: 152 mutants, 143 killed, the other 9 equivalent
- Every one of the 88 static-analysis findings triaged
RTP Fixed-Price Launch
- Unit, invariant, fuzz and fork tests
- Settlement, pricing identities, the fee split, opening protection and cross-chain deployment covered
- Every release gated by its full test suite, mutation testing and static analysis
- Deployment rehearsed through a Safe on local forks
What code enforces,and what the platform adds
Enforced by contract
- No proxy, no upgrade path, no self-destruct
- Pool liquidity has no removal path
- Terms snapshotted per launch; no setter for existing terms
- Pull payments behind re-entrancy guards
- No pause of trading, refunds or claims, on either path
Platform-layer controls (Fixed-Price Launch on RTP.fun)
- Display on RTP.fun: only verified launches shown as verified
- Terms signatures and restricted regions
- Airdrop list rules
- They do not cover a user who calls the contracts directly or uses another front end
Report a vulnerability,privately
security@rtp.fun
Describe the issue, the affected contract and version, and the steps to reproduce it. Please keep proofs of concept and details private until it is resolved.
Bug bounty,after the external audit
A bug bounty programme follows the external audit.
Threat model,to be published with the code
The project keeps a threat model that quantifies the economic limits of its design: the costs of sniping, self-trading, multi-wallet participation and predictable buyback flows. It is published with the code.
Official linksand contacts
| What | Where |
|---|---|
| Protocol | rtp.sh |
| Reference application, one platform among others | rtp.fun |
| Security reports, by private disclosure | security@rtp.fun |
| Licensing enquiries | licensing@rtp.fun |
| Contract addresses | Only addresses in the official deployment registry on rtp.sh are official; the registry is pending publication |